U.S. Department of Justice 



Federal Bureau of Investigation 

Washington, D.C. 20535 

June 8, 2016 


MS. ALEXA O’BRIEN 
MUCKROCK NEWS 
DEPT MR 17650 
POST OFFICE BOX 55819 
BOSTON, MA 02205-5819 


FOIPA Request No.: 1329073-000 
Subject: Carnivore 


Dear Ms. O’Brien: 

Records responsive to your request were previously processed under the provisions of the Freedom 
of Information Act. Enclosed is one CD containing 605 pages of previously processed documents and a copy 
of the Explanation of Exemptions. Please be advised, these are the only copies of these documents located 
in our possession. The original copies of these documents could not be located for reprocessing. 

Additional records potentially responsive to your subject exist. The Federal Bureau of Investigation 
(FBI) has located approximately 1,594 pages total of records potentially responsive to the subject of your 
request. By DOJ regulation, the FBI notifies requesters when anticipated fees exceed $25.00. 

If all potentially responsive pages are released on CD, you will owe $40.00 in duplication fees (3 CDs 
at $15.00 each, less $5.00 credit for the first CD). Releases are made on CD unless otherwise requested. 
Each CD contains approximately 500 reviewed pages per release. The 500 page estimate is based on our 
business practice of processing complex cases in segments. 

Should you request that the release be made in paper, you will owe $79.70 based on a duplication 
fee of five cents per page. See 28 CFR §16.10 and 16.49. 

If you agree to receive all responsive material on CD, you will receive a $5.00 credit towards your first 
interim CD. As a result, we must notify you there will be a $25.00 charge when the second interim release is 
made in this case. At that time you will be billed for the $1 0.00 remaining from the $1 5.00 free of the first 
release, as well as the $15.00 duplication fee for the second release, for a total of $25.00. 

Please remember this is only an estimate, and some of the information may be withheld in full 
pursuant to FOIA/Privacy Act Exemptions(s). Also, some information may not be responsive to your subject. 
Thus, the actual charges could be less. 
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FBI taps of e-mail provoke concerns 

Privacy issues lead to House hearings on ‘Carnivore’ work; Name called 
'unfortunate' 


By Del Quentin Wilber 
Sun National Staff 



its name; "Carnivore. 


ominous as 


Attached to an ISP's server, the contraption sifts through countless e-mail 
messages and copies specific information for federal agents seeking 
suspected criminals, including terrorists and child pomographers. 

But critics say that, in the process of sifting out communications from its 
targets, Carnivore is also capable of retrieving the private messages of 
innocent people. ° 

"This is a very dangerous device," said Barry Steinhardt, associate director of 
the American Civil Liberties Union. "It's unprecedented. It's the first time 

law enforcement has carte blanche access to the entire service provider’s 
network." * 

The controversysunounding the device with the foreboding name has caught 
the attention of Republican lawmakers, and a House Judiciary subcommittee 
is scheduled to hold a hearing on the matter today. Opponents and authorities 
who support the use of Carnivore are scheduled to testify. 

After the system was disclosed in recent news accounts, sparking criticism 
nom privacy advocates, FBI officials met with lawmakers and reporters to 
try to show that Carnivore is not nearly as intrusive as some feat* 

For one thing, FBI officials said, they need the device to combat crime and 
threats to nationaUecurity. They describe Carnivore as a "surgical” tool that 
would protect ordinary people from unintended searches. 

"There are filtering mechanisms built in that limit the amount of information 
viewable to the human eye," said Paul Bresson, a spokesman for the bureau. 

It ensures that only the exact conununications authorized by a court are 
what we intercept/' 

For decades, federal agents and local police have been wiretapping suspects' 
phones after obtaining permission from judges. But those wiretaps are 
limited to a specific suspect and do not comb through phone calls at random. 

Carnivore works much differently, though authorities still must obtain 
permission from a judge to scour e-mail messages or discover which Web 
pages a suspect visits. 


Once they have court approval, agents attach the Carnivore device - 


an 
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ordinal-looking desktop computer - to the ISP's main computer, and 
Carnivore passively sniffs through streams of data, FBI officials said. 

£^S° r ? d ° e \ n0t r ead e * mad messa £ es ot the * r subject lines, officials said. 
Instead, it searches for computer codes that direct the message to and from 
the suspect. Nor can it scan e-mail messages for key words, like "drugs or 
oomo, an FBI official said. 

aut ^ ties say. Carnivore acts like an FBI agent authorized to 
scan envelopes sent by mail. The agent seeks a particular suspect's 
addressing information and pulls aside any qualified envelope and opens it 

Last week, after an outcry from critics, the White House said it would 
propose legislation to among other things, require agents to seek Justice 
Department clearance before asking judges to authorize the use of Carnivore 
in a specific case. Such rules already cover voice wiretaps. 

But the proposal was dismissed by civil liberties groups, who said it did not 
go tar enough in protecting electronic communication. 

For their part, FBI officials say, the White House proposal is not necessary; 
They say they abide by the rules governing voice wiretaps to use Carnivore. 

Despite the assurances of FBI officials, civil liberties groups and 
congressional Republicans say they are war}' of the system. 

? « as ^capabiHty of grabbing it all," said Richard Diamond, a spokesman 
for Rep. Dick Armey, the Texas Republican who is the House majority 
leader and a sharp critic of Carnivore. "It all depends on who pushes the 

bmton. Someone could push the wrong button and have access to all sorts of 
information." v 

FBI officials dispute that assertion, though they concede that Carnivore has 
sometimes captured e-mail messages and data that were not targeted in their 
searches. They say they sealed such information and did not read it. 

Earlier this year, an ISP tried unsuccessfully to prevent FBI agents from 

c S il!r , g C ?™ re an^ts network. After a brief court fight, the company, 
Earthlink, yielded to FBI demands and helped install the device. ^ 

FBI officials say they don't mind simply asking ISPs to provide them with 
e-mai! sent by criminal suspects if that is possible. But, m most cases, agents 
would rather use Carnivore because it helps maintain security for criminal 
evidence. And many smaller ISPs are not capable of creatine urograms to 
obtain the necessary data, FBI officials said. ® 

Though most ISPs have complied with court orders to install Carnivore one 
major provider said it would refuse. 1 

"Wehe not going to stand for this," said William L, Schrader, chairman and 
chief executive officer of PSINet Inc. "It's insidious. If they were to ask us 
with a court order to violate the privacy of all our customers we would take 
this to the Supreme Court." 
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Authorities say that more criminals, especially those involved in child 
comm^rimeT^ ^ 3U ^’ 2re * ncrea singly using die Internet and e-mail to 

About three years ago, agents and federal prosecutors began asking for 

«S2» aCCe$S t0 e .^ aU mi Web ‘ site v > sits > FBI officials said. Ae agents 
said they were worried about not having reliable and up-to-date intelligence. 

FBI technicians began developing Carnivore, which was used for the first 
Snl n m °u a J°* * uthorities FBI officials declined to disclose 

S2I Mm2 rn,V0 '*' reh '' d 0381:5 but said *• system has bee " 

ScusSoSoRwm^m I M 1 r e ", fT 6 - ° f a na ?, e tafag internal 

discussions of the program. At first, technicians called it "Omnivore" because 

frlfft « S5ght ' But ? ? e SyS ?® became wore refined, technicians 

felt it needed a better name and changed it to Carnivore: a meat-eater. 

"^/^ 0 '°? ng 5 how , wenarae a lot of Projects right now," an FBI official 
said. This has been sobering/* 

FBI agents noted that they don't need Carnivore to read most old e-mail 
messages stored on ISP servers; they can already do so with court approval. 

They described the Carnivore system as a last-resort measure to capture 
real-time communications. * 

Authorities on technology and society say they are hardly surprised that the 
system has generated anxiety, because many people now' send more personal 

information over e-mail than over the phone. ^ V 

Corporate snooping of employee e-mail and the unauthorized sale of client 
information by e-retailers have unnerved many computer users. 

Originally published Jut 24 2000 
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FBI: ’Carnivore' will play nice 

During demonstration, details of e-mail ’wiretap* system emerge 

WASHINGTON (Bloomberg) — The FBI's Carnivore e-mail 
surveillance system won't snoop on innocent Internet users, officials 
said Friday, 
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FBI officials gave reporters a 
demons tration of the system they 
say adopts traditional telephone 
wiretap methods to the Internet 
without violating the rights of 
law-abiding Web surfers. 


The disclosure that the FBI and 
Internet service providers have 
cooperated to bug the messages 
of criminal suspects has generated cri ticism from civil liberties groups 
and some Republican lawmakers. They say Carnivore will let the FBI 
see e-mails oi all Internet subscribers, not just the few suspects the FBI 
wants to track. , r 

FBI officials will defend Carnivore Monday before a U.S. House 
Judiciary' subcommittee headed by Republican Henry Hyde of Illinois, 

Earlier this week, the Clinton administration proposed limiting law 
enforcement wiretapping of e-mail to investigations of serious crimes 
and requiring top-level Justice Department authorization of e-mail 


f rom our archive: 



frRsrip reviewing FBI’s Net 
pqretap’ system 


S/ 24/02 Release - Page 5^8 
7/24/00 11:31 AM 




on 




FBI: ‘Carnivore* will play nice 


Shareware Shelf 
Web Potholes 
Web Resources 
Consumer Sites 
Tech Front 

Marketplace 

Hardware 

Accessories 

Software 

Print Edition 
Today 


Subscribe 

Archive 


find books 

up to 50% off! 


Resources 

E-mail 


Feedback 
About us 
dobs at USA 
TODAY 

Free premiums 

USA TODAY 
Update 
Software 


rawr 

.com |i 

Users! fS 


1 /v>w, 


usatoday.com/ljfe/cyber/tecWc 


bugging. Under proposed legislation, die procedures for e-mail 
surveillance would be similar to those in place for telephone 
surveillance. 

Court order 


fnnrt ' Tr* ■ » application tor a 

' Semet wmpSS Cam,vore t0 the computer severs of private 

JSS erS c f n } sin mountains of data traffic generated by millions 
Inten ? et “ m P anies generally let FBI officials who come 
said ° ff s momtor ibs companies’ Internet messages, FBI officials 

Tbe FBI said it's looking for two academic institutions to serve as 

t0 r t0 emUre th - e doesn * £ overreach authority and 
pry mto the online communications of the general public . * 

s b “ n b " 4 25 ,in>es in ,ht ^ " 

, servers of internet companies to weed out messages sent and 
received by people unconnected to the investigation, officials said 

hfnSfif ^ C f dltl ° n of Tbe y sai ^ the Carnivore filter 

bystendeS f0rcement ° fficials from seein S the e-mail of innocent 

a J read y ha ^e their ow filtering systems that 
extraneous data, officials said. '* ^ ' V ^ 




|at€C80W| 

flight mnckgh 


Weather Maiketofaeg 
# Copyright 2000 U § A J [ QS AY, a division of Gannett Co, toe. 


room 

•com 


2 of 2 


5/24/02 Release - Page 289; 

7/24/0011:31 


GOP.gov 


HOUSE REPUBLICAN CONFERENCE 


Reforming Washington 
Securing America '.v Future 



For Immediate Release 
Monday, July 24, 2000 


Contact: Ron Bonjean/Kevin Schweers 
(202)225-510? 


Watts: FBI’s ‘Carnivore’ System 
a Dangerous Invasion of Privacy 

Calls on Clinton-Gore Administration to Suspend New Surveillance Program 

WASHINGTON - Rep. J.C. Watts, Jr. (R-OK), Chairman of the House Republican Conference 
and House Republican Cyber-Security Team, issued the following statement today on the FBI’s 
‘‘Carnivore*’ system at a Capitol Hill hearing; 

nve need innovative, new law enforcement strategies to combat the real and growing threat of 
cyber-crime. U.S. law enforcement needs to focus resources on the training and expertise 
necessary' to protect our cyber-security, 1 remain committed to working in Congress to 
adequately invest in and support the right law enforcement tactics. 

“However, the FBI’s ‘Carnivore’ program represents a dangerous and unprecedented invasion of 
online privacy. Despite repeated inquiries, the Clinton-Core Administration continues to offer 
only vague responses and little enlightenment. 

The FBI s record on protecting privacy is also problematic. From unwarranted wiretaps to its 
mishandling oi hundreds of files on political appointees just a lew years ago, there is ample 
cause for concern. 

“Before we impose privacy restrictions on the commercial industry, it seems the federal 
government has a duty and an obligation to honor the privacy of the people it has sworn to 
protect. I commend Chairman Canady for highlighting this egregious threat to the online privacy 
of every American .” 

-- EN D - 
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House Committee 

FBI E-Mail Surveillance Program 

Judiciary 

Washington, District of Columbia (United States) 

Rayburn House Office Building 

ID: 158376 - 07/24/2000 - 2:00 - No Sale 

Hyde, Henry X, U.S. Representative, R-IL 
Baker, Stewart, Attorney 
Cora-Revere, Robert, Attorney 

DjGregory, Kevin, Deputy Assistant Attorney Gene, Department of Justice 
Mem ha rdL Barry, Associate Director, American Civil Liberties Union 
Kerr, Donald, Director, Federal Bureau of Investigation, Crime Lab 

Committee members hear testimony on a computer program called 'Carnivore* that will allow the FBI 
intercept and collec t electronic communications that are the subject of court orders. 
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C-SPAN Networks 
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Previous Day 07 { / 24 | / 2000 
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Current 3 Months 
Search the C-SPAKi Schedule 


Time 


C-SPAN 

Program 


Back to Current Schedule 


07:00 amCWH» 

I : j 5 Open Phones 

) C-SPAN, Washington Journal 

LIVE 


08:15 8 ta p]p| fltl Y ^ 

{©Si ) C-SPAN, Washington Journal 
2j^Massimo Cslabresi , ro/t: Magazine 


09:00 arn ^ n tlt Hfsmrv rtfpn ;- 

Washington Journal 

LIVE 


09:30 am «-|» ni ; nF ■ 

{est,}^" "SPAN, Washington Journal 


10:03 am can* 

\ : 14 Qgfin. Phones 
(ggt ^ C-SPAN, Washington Joumal 


11:20 amCaji-fn 

0:43 Mgehjigs 

fest ) C-SPAN, Washington Joumal 
- ' ''Massimo Calabresi , TM£ Magazine 


Time Program 


C-SPAN 2 


88:01 am s r s 

1 ,\2 5 AM .gate ----- 

fest } ^ orum m Health Care Leadership 
v v v Leah Cmm , Cum s Cans 





09:49 am s M 

Virginia Young Republicans 
Tom Davis „ r~va 


1 0:22 axn National Press Club Speech 

n-CAjtedtoa togvartd Global 
(est.) 

V * National Press Club 

Robert Davis , Lycos, tee. 


1 1 ill Bin News Conference 

0:36 B^BMMLSe legates Platform Pn|l 
(est. ) Amer ^ can Conservative Union 

Donald Devine , Forbes Presidential Campaign 


1 2 ; 8 0 p m 

fest } ^ ^ Senate 

/ n/i ^zbtgmmng and end of this live, program to be 
Ljl r £ earlier or taler than the scheduled titties. 
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(6St«} House of Representatives 
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0:2 $^mmmilimk}m 

{esL><^^ Washington Journal 
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01 :00 pm House Commit tee 

2 ; OQ EBI E-Mat i Surv eillance Program 


(est.Kr - u ^ 

) n ,ill<iwy I Hyde , R-SL 
iy/p L g[ ewar { Baker 


The beginning and end of this five program may be 
earlier or later than the scheduled times , 


03:00 p 

' 1: 


C-SPAIS’ Radio 
Time Program 

07:00 a 
6: 


01 :00 pm House Committee 

2‘Qo£Bl£Ma ii Surveillance Pro gram 

(est) Judicia^ 

) -'Hear y L Hyde * mi 
Stewart Baker 

The beginning and end of this lire program may he 
earlier or later than (he scheduled times 

03:60 pj 
1:C 


04 :00 pot House jConm'ttec 

^jy^Judkmry, Constitution 

Forres t McDonald * University of Alabama 
Charles Canady , r~fl 

7he beginning and end of ihh live program mev be 
earlier or later than (he scheduled times. 
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Charles Canady ( r~fl 
The beginning and end of this live program may he 
earlier or iaur than the scheduled times 
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ADDITIONAL CARNIVORE DOCUMENTS 


FROM 

OFFICE OF GENERAL COUNSEL 
INVESTIGATIVE LAW UNIT 
(THROUGH 7/28/00) 


PAGES REVIEWED: 132 

PAGES RELEASED: 132 

EXEMPTIONS CITED: b6-l, b7C-l, 

b6-3 & b7C-3 


NOTE ; 29 Pages from this file are duplicates to pages from 
The Office of General Counsel’s Front Office file and 
The Office of General Counsel/Technology Law 
Unit’s file. 
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LSM JO: REJ280 


FROM; 

OM6 CONTACT; 


SUBJECT; 

DEADLINE; 


EXECUTIVE OFFICE OF THE PRESIDENT 
OFFICE OF MANAGEMENT AND BUDGET 
Wash* ns ten, D.C. 20£D3^J0at 

Tuesday, February 29, 2090 

tESiSUTWE REFSRRA L MEMORANDUM 

L&gisisc-ve Usison Cffesr - Sea Distribution beiow 

(fer) Assistant Director for iBgislakVa Reference 

1 Mai 1 1 1 ecp.ci ii 

phc ^hb mmm 

Cm Request for Viaw* on S2D92HSghTecri Crime Bill 
Wednesday, March 3, 20C0 


/ff- 


tn accordance wifr CMS Circular A. 19 , OMB requests the views cf ycur agency on the s^cve ™>nVr» 

•ffSSnS " 8 B °5 'SkliOMWjj b the program of ihe President Pleas* 3 < tWs* us if tfcL Lm'will 

r T^ dfnS ° f rec ^ iQr l»*pc*w * «* M ^y*As.You^o- provisions £™?££ of 
trie Omnibu* Budget ReeoncSiatJon Act of tm P T ' 8 * II! of 

COMMENTS; A copy of S, 2592 Is attached. 

Jttsrtica: Please advise of any plans to prepare a views letter ©n*$. 2092. 

DiSTRIBUTICM t Jgy 
AGENCIES: 

fi!~JUSTIC£ - Robert Raben ♦ £ 232 } 5 ) 4*2141 

1£* TATE -Pmi ntOmtdm . { { Q7) 

^TOE,-£NS 5 - Samuef 7 . Snot it. - (7033 637-1305 
.It.' R 6 A 5 URY - Richard S. Carrs - { 202 } S 22 -GS 5 C 
^-COMMERCE * Michael A. tsvstt - ( 202 } 432-3151 

i«f?- n ’ unta3acm Commission - Shsryl Wilkerscn * (202} 41 3-1 SCO 

"^iRune® Agency - Cynthia 0 . Ensfcna - ( 7 C 3 ) 482-0825 
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Lauren S. Steinfsid 
Martin L, Ysun^ 
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CONGRESSIONAL RECOJRB — SENATE 


February 24, 2000 


non 6 ilfoKlj of such Codo 1$ 

^ oy inserting "{th« toe of the tract- 
m<t\< sf the American Transport Reecv* 
efy Act loca, in the ease <f sfttsel fuel)" 
aft*r "October U ZW&" both pUca ft ap* 

pftaCSr. 

JB) fay inserting "(the to* which U S 
months after the date of the mactment of 
such Act, in the ease af dftset fueO after 
"March 3i. im" both ftota it appears, and 
tC} by inserting "(tfa* to* which ft 3 
months after the date of the enactment of 
such Act, in the cast of diewi fuel} after 
‘Uanu&ry i* 

(4) Sootinn f42?ffM$ a/ such Code is 
ed fay inserting ''(during the 1 year period fa*N 
ginning on the date of the enactment of the 
American Transportation Recovery Act of 
tm, in the case sf dftael ftrilT After "Sep- 
tember 30. 20OT\ 
fr) effective Date.— 

0) Jh cefJEJUL.-Exeepa as provided in 
paragraph €?)„ the amendments made fay this 
section shall take effect on the date of she 
tnactmcnt of this section, 

0 DeCREASE IN QlUDS Oil Fmcsi— If she 
Secretary of Treasury determines that the 
average refiner acquisition costa Ear crude 
oil are equal to or less thin such costs were 
on December 3J, ipst, the amendments made 
fay this section shall tease to tafca effect and 
the Intemai Revenue Code shall be tordoft- 
ter^d £3 if such amendments did nee uke ef- 
feet. 

By Mrs, FEIMSTEIH: 

S, 20$ i. A bill to amend the Act that 
author***** construction of the San 
Luis Unit of the Central V&Iiey 
Project, California, to fecititatc water 
transfers in tha Central Vadky Project; 
to the Committee on Energy and Nat- 
ural Resources. 

CCNSTRUenSN OF THt $AN U*T$ tlW? OF 

THE central VALLEY PROJECTS 

Mrs. FEIN STEIN, Mr, Pratident* 
today I Introduce a bill to amend the 
legislation that authorised comtruc- 
ticn of the San Luis Unit of the Cen- 
tral Valley Project In California, En- 
actment of this bill would allow water 
districts in the San Luis Unit of the 
Central Valley Project to supplement 
their fedejnl water supplies with pur- 
chases of water from the State Water 
Project. At present, federal law pro- 
hibits the delivery of non-federal water 
ro districts In the San Luis Unit until 
certain conditions are met. 

The Sen Luis Unit is the last compo- 
nent created by federal law in the Cen- 
tra! Valley Project, which Is ths larg- 
— purcuu M prejset in 

the United Starts. Water service to dis- 
tricts in the San Luis Unit is often cur- 
tailed because of limitations imposed 
in pumping In the Sacramento- S&n 
J coquin Delta. 

It is customary for water districts in 
the San Luts Unit to supplement their 
supplies through purchases m the open 
market. However, current federal law 
prohibits them from purchasing sup- 
phes from the State Water Project and 
having chase delivered over federal fe- 
ci liters. Making such deliveries is rel- 
atively eesy because state and federal 
project conveyance facilities are inter - 
connected. Prohibiting purchase . of 
state water for deliver/ over federal fa- 
Cilices Umics the opportunities ovaih 


able for San Luis Unit districts to ob- 
tain as large a supplemental supply as 
they would like. 

Mr. President, this bill has already 
passed the House as H.R. 3077, U will 
Impose no additional costs on the fed- 
eral government. It contains provisions 
which assure that the additional water 
obtained fay districts in the San Luis 
Unit cannot be used in a manner that 
would exacerbate current groundwater 

drainage problems* It is consistent 
with the provisions in the Central Val- 
ley Project Improvement Act that 
sought to encourage the exchange of 
water by willing sellers to provide ad- 
ditional supplies at reasonable case to 
willing buyers. I urge the Senate to 
pass this bllL 

By Mr* SCHUMER (for himself 
and Mr. KvQ: 

$* 2332, A bill to amend title 13> 
United States Code, to modify authori- 
ties relating to the use of pen registers 
and trap and trace devices, to modify 
provLsiQns relating to fraud and related 
activities In connection with com- 
puters* and for other purposes: to the 
Committee on the Judiciary, 

ttlCKTECK OUMEBSJL 

Mr. SCHUMER, Mr, President, I riso 
today to introduce with my friend from 
Arftsma. Senator KVU a high tech 
crime bill aimed at combating com- 
puter crime. For the past nine months 
I have been discussing with law en- 
forcement and computer crime experts 
how bast to address the growing threat 
that computer crimes pose to our In* 
crtatingly networked society. 

Many of the best solutions are far* 
reaching and complex and will only ba 
achieved through sustained and 
thoughtful hard work on m inter- 
national level by both government and 
the private sector in the years ahead. 
There are, However, modes changes to 
existing taws that can be made now, 
which will serve as a significant first 
step In a much- needed effort to give 
law enforcement to todh they need to 
effectively fight cyberciime. The legis- 
lation that Senator XYt and I are in- 
traducing today wiIL among other 
things, make the following changes to 
existing law. 

Wc must update our law? governing 
the use of what art called pen registers 
(which record The numbers dialed on a 
phone line} and crap and croc* devices 
(which capture incoming eiecxrcmc im- 
pulses that identify the originating 
number}. Theta laws have become out- 
dated and their procedures are too slow 
for the speed of criminals online. 

Under currant law. investigators 
must obtain a trap and trace order in 
each Jurisdiction tlvough which an 
electronic communication is made. 
Thus, for example, to trace on online 
communication between two terrorists 
that scares at a computer in New York, 
goes through a server in New Jersey* 
bounces oil a computer In Wiscomfn. 
and then ends ;n Son Francisco, ;nves* 
ti go tors may be forced xo |C suctss- 
lively to a court in 2 sch j urixtiction 


for an order permitting the trace (not 
to mention having to approach each 
provider along the way). In the reconc 
Denial of Sendee attacks, hackers uti- 
Lced doaem or even hundreds of 'Ydm* 
hit* computers from which the attacks 
on specific sites were then launched. 
No doubt, these computers were 1c- 
cat&d all over the country, and emcing 
them quickly under current law ts 
therefore virtually Impostihle, 

This legislation will amend current 
law to author tze the issuance of a sin- 
gle order to completely trace an online 
commurUcaticn to its source, regard- 
less of how many intermediate sites It 
passes through. Law enforcement must 
still meet the exact same burden to ob- 
tain such an order; the only difference 
la that they will not hove to repeat 
this process over and over eech time a 
communication passes to a new csrrief 
in a different Jurisdiction, 

One defttiency of the Computer 
Fnaud and Abuse Act* U U.C,C, 1 1D3D. is 
Its requirement of proof of damages in 
excess of SS.&02, In several cases, pros- 
ecutors have . found that while com- 
puter intruders had attempted to harm 
computers vital to our critical infra- 
structures, such as telecommuni- 
cations and financial services, damages 
of S 3,300 could not be proven. Neverthe- 
less, these Incrusiom pose a great risk 
of harm to our country and must be 
prosecuted, punished, and deterred. 

The 5chumer-Xyi bill will unambig- 
uously permit- federal jurisdiction at 
the outset of an unauthorised intrusion 
into critical irvfrasmicture systems 
rather than having investigators wait 
for qny damage assessment. Crimes 
that exceed the $5,000 limit will be 
prosecuted as felonies* while crimes 
below that amount will be defined as 
misdemeanors. The bill will also clar- 
ify that a $5*000 loss resuking from a 
computer attack may include the costs 
of responding to the offense, con- 
ducting a damage assessment, restore 
Ing a syst&m to its original condition, 
and any lost revenue or costs incurred 
as a result of an interruption in serv- 
ice, The $5*300 requirement should not 
Strve as a barrier to the prosecution of 
serious computer criminals who threat- 
en our country's networks. 

This legislation wtU also modify a di- 
rective to the sentencing commission 
contained in the Antiterrorism ond Ef- 
fective Death Ptn&lzy Act of 1SSL 
which required a mandatory minimum 
sentence of six months' imprisonment 
for certain violations of section 1030, 
Computer Intrusions that violate the 
statute vary ;n their severity or.d mail- 
ciousness. Ail violations should be pun- 
ished. but under the current regime the 
mandatory imprisonment applies to 
some misdemeanor charges, even where 
the attack caused no damoge. As a re- 
sult, some prosecutors hav* declined to 
bring cases, knewmg that the result 
would be monastery imprisonment. Ws 
sheuid Insure that federal prcsecutcrt 
are bringing cotes under section 1333 
but we also should insure that the sen- 
tences being me:? b out fit the crime. 
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nost technologically savvy our ml son, ami 4vsry federal dollar al- Mr, President* since l came to the 
^ are juvenile* who have located for Improving this situation Senate In 1SS3, I've worked hard to 
V? with computers always at should be directed to our nation's In- mote economic development and create 
-*r fingertips, unfortunately* certain dian mr/s itinns. The lack of adequacy n*w *ob$ for my sxace of Hew Mexico 
juvent.es are committing the most sc* roods and bridges is a chronic problem One 'thing I learned vm auteklv =< 
r-cus computer crimes and wreaking on Indian reservations, where unem* that vou can't expect to ittret 
havoc on our critical infrastructures, plcyment averages 3S percent and more industry unless vou have the bassr^T 

SV:a.tt »£L$— — — sS&aSiSsSs 

s !l ut <s ° wn for av * r six Stnce ISSt when my Senate amend* Infrastructure needs fnlwt rXl.HZ 


CONGRESSIONAL BJCOR0— SENATE 


Juveniles 


caused an airport In Worcester, Massa- 
chusetts to shut down for over six 


Qown jor over six amci isa*, wnen my ben&ts amend* infrastructure ^ 

hours when Sts telecommunications mem added Indian roads w our federal ration power colrmuni^tolf u! P ° r ' 

conmetions were brought down. Simi- highway trust fund accounts, all funds and sew^ 

tarly, cv^o California teenagers broke allocated for Indian roads ha^t been j ces at ^f Qr Uahi*> rAWM . * ***** 

Into sensitive military computers* In- used for chat purpose, in t$TEA v which ^ create rood ieL JSujS 1 **” j** 
eluding those at Lawrence Livermore preceded the enactment of the Tram* vekra, ^ * bs will simply not de- 

National Laboratory and the U.$. Air parration Efficiency Ace for the 2lst Today our cnunrrv *< 

* iencer term *rrat«~ ^ Century CTEWfi. the Indian Reserve have one of the strongest economlw in 
as a !Cnger term strategy, wonted to ticn Roads (IRR) program reached a history Our rmm IJuJ.. . • ■ ’ m 

do a better job of teaching wr children level of J»I million per year. aSoHkd f T J °° cr *' 

from a very young age that. Ilk* any- Many of us la Oweress worked hard olishment, ofc a l co, ?j 

where else, certain conduct on the to Increase this IRR funding to SltS „ 1 U Am f lcaf » should 

Internet Is wrong and illegaL But we million in the first year of TEA-2! £FY XT *"• ^fortunately, as many of 
also need to send a clear message that 1 mi and «« million each year there- ^2ZZ\T\ »«ow «f '*** "? tion 
crimes on the Internet will have real after, through FY 2003. Unfortunately. * * iag , b * hl , nd **» we ec °- 

consequences. This legislation will a little noticed provision for Federal ^ ' t** ?** "**<* th * 

amend IS U.S.C. SiS3a t0 give federal Lands Highways, placing an “obliga* XTr^* f? p f mcula f; 1 r * m » in »»* 
law emoreement authorities the power tion limitation" on the IRR program, TT C Natlve American 

to investigate and prosecute juvenilt has resulted in the transit of funds In- f*^' l' nem P lo l' n ' en t rates 

offenders of computer crimes In appro, tended for Indian reservations- to be ,, J; ” Country frequently top 

priate oases. The bill will make juve- transferred to the SG states. ’ 7' * l m evan 50 P*««ac-Mr. Presj. 

ni.es fifteen years of age or older who In FY 1138, the amount deducted for . r*f, nation must not stand by 
commit the most serious violation of this transfer m stats* from the IRR Country is literally being 

section 1336 eligible for federal prsstm* program was 520 million. In FY 15S5, ie *f behirt<i * Perhaps more than any - 
tion in c^es where the Attorney G$a- it was $3 U million; and In FY 2000, the 25^5 r community in America, the 
eral certifies that such prosecution {* obligation limitation resulted In a loss J n ™ A^ka Native Villages suf- 
appropriate. In conjunction with the af W-3 million that could have been re U? m inadequate infrastruorure* 


section 1030 eligible for federal prostcu* 
tian m ccs*es where the Attorney Can* 
era* certUie* that such prosecution is 
appropriate. In conjunction with the 
elimination of the six-month moods- 


used for Indian reservation road build- 


Thi* y*ar I am pleased to be working 
with President Clinton, Senators 


tory minimum, this legislation will Clinton, Senators 

provice a balanced measured approach all previous enacting legislation wmemcj, and others on a 

to juvenile hacking crime*, since mi, federal funds Intended for w new pregrams and initia- 

Again, these are just the first steps programs have been used for IRR i iVs5 co help the Native American 
that should be taken in a very long purposes. Only in TEA-21 was this Communities enjoy the same love! of 
battle against cy'bef trime that many ei changed due to the application of the ^ C0nQ ^^c prosperity as the rest of 
us will wage for years to come. And obligation limitation to Federal Lands res P^£ L the Tribe* are 

while we fight computer cHme bv Highways and the IRR ? regram. no difTereot than the rest of America^ 


while we fight computer cHme bv Highways and the IRR program no different than the rest of America—* 

modifying our criminal laws, we also bill will simply exefude th’e IRR promote their economic develop- 

should seek concomitant way* to fully P^fram from this annual deduction p cnc bq&lc infrastructure must First be 
protect the fundamental rights of lr.no- ha* totaled, in the pest three in P^ce, The President's initiative rec- 
cent individuals on the Internet, years, more than 5S0 million. This ogoites this fact. The bill we are intro- 

1 want to thank Senator Kyl for join- momy, while helpful to many state*, is ^u^ng today addresses one element of 
ing me in introducing this bill. As more badly needed on Indian reserva* ^hat initiative — the need for basic 
cheJrmajn of the Subcommittee on tions and should be preserved for that transportation, including road* and 
Technology, Terrorism, and Cavern- purpose. By excluding the IRR program transit. This hill will help promote 


chelrowi of the Subcommittee on tions and should be preserved for thai 
Technology, Terrorism, and Covem- purpose. By excluding the IRR ptogjarr 
ment Information, l know that he From this obligation limitation provl 
cart* deeply about these Issues and I sim we will be increasing federa 
look forward to working with him m fund* for Indian road* without Increas 
this cemmomemet bipartisan leg isla- ing the cost of the total program, W< 


and Mr. 


from this obligation limitation provl- transportation on mtt y reservation In 
sioa we will be increasing federal America by fully funding the Indian 
fund* for Indian road* without Increas- Rflservac ion Roads Program, 
log the cost of the total program. We ^ irst estabUshed in 1 m the Indian 
will be focusing the fund* for Indian Reservation Roads program is one of 
u \ * ^ s „ roods on Indian roads, as we have in- the ways America meets its special re- 

, ^ or . tended since iht IRR program first he- sponsibmty to help Motive Americans 


carr ? sf cur federal highway trust 3chie-/e saif sufficiency and self dec? 


minatiom The goal of Indian 
ervation Road* prog ram i$ to provide 


; curcosev 


Over the years, the program ha* bee 


« +«*+rL n , . _ f««d In mlimiom The goal of Indian Rss- 

v Tt /v . ai the Transpor- I urge my colleagues to join us in re- ervatioti Roads pregram i$ to provide 

tst*on equity Act for the 2 1st Canter/ directing funds intended for Indian cafe and economic me&ns of tra«ueor* 
to incurs that ,uil obligation author, ty mad construction to be dedicated to "zzion throughout Indian Country. 
^ for the Indian reseda tier that purpose * Over the years, the program ho* been 

roads program; to the Committee on Mr. S INCAM AN. Mr. President, I am rtmtho^d and modified to help meet 

r*«viror.menc and RubUc Works, pleased to join today with my s cod the Tribes’ needs for baulc transport 

SCVrrv act fc« ms :*5T friend and colleague from Mew Mexico, totion infrastructure. Most recentiv, 

. w * lf !5 rc ^ c ^ :he program was reauthom^d for six 

M . yX ' ^wNfE.4lU- Mr. President, I om bill along mth Senator BalCLS, This years in im. The program is playing 6 

Jy my <st* MU assure stos curyM AawkM critical rote in ecinoroic dev*iow»««t. 

***** 3ac * eon f sw ? tJ< * hav * i h ® fewSS «8 «^y s^if-dcter.Tiirwcion. and ^otpiovroertt ci 
:;l: ksistocon «> Pf"' oe4frf fe £ tip 81 ,, Nativa Am srlcafis in 33 states. IncSurf* 

r^,ous ooUar* oOocuted by the project*, uur bill ^il fund the Indian the Alaska Native Villages 

tne President hr con- Reservation R^sad Program for the mxs Currency, the r^ervatioo rood* *ys- 
tt£»ict:an cf Indu-in rtsor/atloa roods. three years with *r least iVS rmliion t«m comersse* $$ tro nf a?A- and 


Mr* B INC AM AN. Mr. President, I am reauthorized and modified to help meet 
pleased to join today with mv good the Tribes’ needs for baulc transport 
friend ana colleague from New Mexico, tstion infrastructure Most recent lv 


.augues Jeff Bincaman and Max Sac- 
vV* m Introducing kgiskeon to pre- 
jf r - Pilous dollars allocated by the 
uengrass and the President for con- 
struct: sn cf Indian r*cer/atlon roods. 


suet that Indian r**- p«r veor. the full 3m cunt authors 


e th«y self-determination, and employment of 

^transportation Native Americans in 33 stats*, Includ- 
,und L.e Indian mg the Alaska Native Villages, 
ram ;cr the next Currently, the reservation road* sys- 
nst 12“! rmlUon tem comprise* 2£JC8 miles of 3LA- ond 
ot author ued by Tfib^j-owned roads and 2S,B0O mile* of 
stats, counsy end local roods. Titer* 
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(1) by inserting “or trap and trace device 5 ' 
after “pen register’,* 

(2) by msernng routing, addressing.” after 
“dialing”; and 

' (3) by striking’ “call processing” and inserting 

“the processing and transmitting of wire and elec- 
tronic communications”- 
fb) ISSTAh'CS OF OeBBSS.— 

(1) In gsxfPvAL.— S ubsection {a} of section 
3123 o: that tide is amended to read as follows: 

-'•(a) U? GsNSRai.— (1) Upon an application made 
under section 3122(a)(1) of this title, the court shall enter 
an ex parte order authorising the installation and use of 
a pen register or trap and trace de-ice if the court Suds 
that the attorney for the Government has certified to the 
court that the information likely to be obtained by such 
installation and use is relevant to an ongoing criminal in- 
vestigation. The order shall, upon service or the order, 
apply to any entity* providing ■wire or electronic corrunu- 
mcafcon service xn use u *nce cx aitu^-s tvx-oss »-we -a 

required to effectuate he order. 

w (2) upon an application made under section. 
3122(a)(2) of this tide, the court shall enter an ex parte 
order authorizing the installation. and use of a pan register 
or nrao and mace deuce within the jurisdiedon, of the court 
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1 

if th. 6 court finds th&t 6 St&ts Isw sTHorcsmcnt or *nv€$* 


2 

tigativa officer hss cerdfiad to the court that tns 


3 

lion likely to be obtained % such installation and use is 


4 

relevant to an ongoing criminal m-vestigatiorL”. 


5 

(2) Contents of okdse.— S ubsection (b)(1) 


6 

of that section is amended— 


1 

(A) in subparagraph (A)— 


E 

(i) by inserting “or other facility” 


9 

after “telephone line”; and 


10 

(ii) by inserting before the semicolon 


n 

at the end “car applied”; and 


12 

(B) by striking subparagraph (C) and in* 


13 

setting- the following new subparagraph (C): 


14 

“(C) a description or the communications 


15 

to which the order applies, including the mem- 


16 

ber or other identifier and, if known, the loca- 


17 

tion of the telephone line or other facility to 


18 

which the pea register or trap and trace device 


19 

is to be attached or applied, and, in the case of 


20 

* - — order auct*om.mg — — 

Jit 

21 

trap and trace device under subsection (a)(2), 


22 

hoc geographic limits of the order, and”. 


* * 

(3) MONBJSChOSUES BSQTIBSOSNTS. — Sub- 


24 

section (d)(2) of that section is amended— 



2jOQ6 
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SA.C. 


2 

A 

0 

4 

5 . 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
<5*5 
05 


(A) by inserting “or other faculty’ after 
“the lice”; and 

(B) by striking “or v?ko has been ordered 
by the coon” and inserting “or applied or who 
is obligated by the order 51- . 

(c) BMER&ENC7 INSTALLATION. — Section 

> 125(a)(1) o£ that title is amended — 

{1} in subparagraph (A), by striking “or” at 
the end; 

(2) in subparagraph (B), by striking the comma 
at the end and ins erring a semicolon; and 

{3} by inserting after subparagraph (B) the fol- 
lowing new subparagraphs: 

“{€) immediate threat to the national se- 
curity interests of the United States; 

“(D) immediate threat to public health or 
safety or 

“(B) an attack on the integrity or avail- 
ability of a protected computer which attack 
w»la be an crfense puaishabla under rcriicu 
1030(e)(2)(C) of this title/ 5 . 

(d> B-HNI7I0NS.™ 

{1} COUKT OF CONPLTLNT " • JURISDICTION. — 


24 


Paragraph (2) of section 3127 of , that title 



if oor 

iJOOS 
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igjaos 

sx.a 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 


12 

13 

14 

15 

16 

17 

18 

19 

20 
91 


22 


24 


amended by striking subparagraph (A) ana. inserting 
the following new subparagraph (A): 

“(A) any district court of the United 
States {including a magistrate judge of such a 
court) or any ’United Stiles Court of Appeals 


having jurisdiction over the offense being inves- 
tigated; or”. 

(2) Pen segistee.— P aragraph (3) of that sec- 
tion is amended— 

(A) by st riking “electronic or other im- 
pulses” and all that follows through “is at- 
tached” and inserting “dialing, routing, ad- 
dressing, or signalling information transmitted 
by an instalment or facility from which a wire 
or electronic communication is transmitted”; 


(B) by msertmg “or process” after “de- 
vice” each place h appears. 

(3) Thu? i>m T2tiC3 DEVICE.— Paragraph (4) 
o: that section :s amended — 

(A) by inserting “or process” after “a de- 
vice” ; and 

(3) by striking “of an instrument*’ and all 
that follows through the end and inserting “or 
other eiriirr, routing, addressing, and signsi- 
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1 Hng information relevant to identifying die 

2 source ot 2 ndre or electronic communication, . 

3 $EC. 2. MODIFICATION OF PROVISIONS RELATING TO 

4 FRAUD AND RELATED ACTIVITY' IN CONNEC- 

5 TION WITH COMPUTERS. 

6 (a) Penalties.— S ubsection (c) of section X030 of 

7 title IS, United States Code, is amended— 

8 (1) in paragraph (2}-~ 

9 (A) in subparagraph (A) — 

IQ (i) by inserting “except ss provided in 

11 subparagraphs (B) and (€),“ before “a 

12 fine"; 

13 (il) by striding ‘'(a)(S)(C}/ ! and in- 

14 setting “(a)(5), ! and 

15 (iii) by striking “and" at the end; 

16 (B) in subparagraph (B)— 

17 (j) by inserting “or an attempt to 

18 commit an offense punishable under this 

19 subparagraph," after “subsection (a)(2)," 


m tse matter pmeecng clause y..; :n,. 

(*i) by adding “and*’ at the end: and 
(G) by striking subparagraph (0) and in- 
serting the following new subparagraph (C): 


<itr\ a 


under this title or imuriscnment for 


>t more rbo- 10 years, or both, in the case of an 
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I 

offense under subsection {a)(5 j(A) or ( 2 ,)(o)(B), or 

2 

an attempt to commit an offense punishable under 

3 

this subparagraph, is the offense caused (or, in the 

4 

ease of an attempted offense, would, if completed. 

5 

'have caused) — 

6 

«(i) loss to one ox more persons during any 

7 

one-year period (including loss resulting from a 

3 

related course of conduct affecting one or more 

9 

other protected computers) aggregating at least 

10 

$5,000 in value; 

a 

“(ii) the modirication or inpayment, or 

12 

potential modification or impairment, of the 

13 

medical eiamxcahon, diagnosis, treatment, or 

14 

care of one or more incividusls: 

15 

“(iii) physical injury to any person.; 

16 

«(jv) a threat to public health or safety; or 

17 

"(v) damage affecting a computer system 

18 

used by or for a government entity m further- 

19 

ance of the admirisiratiou of justice, national 

20 

defense, or zsdonzi securing and”; 

21 

(2) by redesignating subparagraph (B) of para- 

, y 

22 

graph (3) as paragraph (4); 

■r\*> 

/ 

(3) m paragraph (3) — 

74 

(A) by striking “(A)” at the beginning; 

25 

and j 
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S 

(3) by striking ", (a)(5)(A), (a)(5)(B) /’.; 

* t 

1 

X. 

1 

** 

D 

ana 

(4) 3 paragraph (4), as designated by para- 

4 

graph (2) of this subsection, by striking “(a)(4), 

5' 

'(a)(5)(A), (a)(5)(B), (a)(5)(C)/’ and inserting 

6 

“(a)(2), (a)(3), (a)(4), (a)( 6 )/’. 

7 

(b) Definitions. — Subsection (e) of that section is 

g 

amended-- 

9 

( 1 ) m paragraph ( 2 )(B), by inserting imelud- 

10 

ing a ccmpoter located outside the United States” 

11 

before the semicolon; 

12 

( 2 ) in paragraph (7), by striking “and” at the 

13 

end; 

14 

V 

( 3 ) by striking paragraph (S) and inserting the 

15 

foUovring paragraph (o): 

16 

“(S) fee term ‘damage’ means any impairment 

17 

to the integrity or avahabCity of data, a program, a 

IS 

system, or information/’; 

19 

( 4 ) in paragraph (9), by striking the period at 

20 

the end &a 'inserting ; anc* ; ana 

21 

( 5 ) by adding at the end the following new 

yj 

paragraphs: 

23 

«n 0 ) fee term ‘conviction’ shall include an ad- 

24 

judication of iuvsnite delinquency for. a violation of 

25 
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1 "(ll) the term loss’ means any reasonable cost 

2 to any victim, including the cost of responding to an 

3 offense, conducting a damage assessment, and re- 

4 storing the data, program, system, or information to 

5 its condition prior 'to the offense, and any revenue 

6 lost or cost incurred because of interruption of serv- 


7 ice.". 

8 (a) IXcos BS IK Civil Acno?^,— Subsection (g) of 

9 that section is amended in the second sentence by striking 
10 “involving damage” and all that Mows through the pe- 
ll riod and inserting “of suoseetion (a}(o) shah be limned 

12 to loss unless such action includes one of the elements set 

13 forth in clauses (ii) through (v) of subsection (c)(2)(C)”- 

14 (a) CBDGKAL ?CEFSrnJKS,— That section is farther 

15 amended by adding at the end the following new sub- 


16 section: 

17 The court, in imposing sentence on any person 
I B convicted of a violator of this section, shall order, in addi- 

19 tion to any other sentence imposed and irrespective of any 

20 provision of Stats law, that sucn p&rocr. r oners tr an 2 


21 United States — 

22 “(A) the interest of such person in any prop- 

23 eny, whether real or personal, that was used or in- 

24 tended to be used to commit or to facilitate the coxn- 

25 mission of sum uoia*;orr ar.d 



3§<12 

®cio 
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"(B) any property, whether reel or personal. 
coRstimmif or derived from my proceeds that suer 
person obtained, whether directly or indirectly, as a 
resuit or such riolanon. 

... “(2) The criminal .forfeiture of property -under this 
subsection, any seizure and disposition thereof, and any 
administrative or judicial proceeding relating thereto, shall 
be governed by the provisions of section 413 of the Con- 
trolled Substances Act {21 U.S.C. 853}, except subsection 
(d) of that section.”. 

{e} Crm FoEjEITUSS. — T hat section, as amended 
by subsection (a) of this section, is farther amended by 
adding at the end the fohowxng new subsection: 

**{j){l) The following shall be subject to forfeiture to 
the United States, and no property right shall exist In 


“(A) Any property, whether real or personal, 
that is used or intended to be used to commit or to 
facilitate the commission of any violation of this sec- 


“(B) Any property whether res 


OV**v**j 


that institutes or is cer.vea from proceeds traos 
able to anv rioisdor. of'fhis section 
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1 “(2) The pwwsioas of chapter 48 of this uxle relating 

2 to civil forfeiture shall apply to any seizure or chfl for* 

3 feiture under this subsection.'". 

4 SEC, 3. JUVENILE DELINQUENCY. 

5 - Qanse (3) of the Srsi paragraph of section 5032 of 

6 title IS, United States Code, is amended — 

7 {1} by striking' ‘"or” before “section 1002(a)’ 5 ; 

8 (2) by striking “or” before "section 324(b)”; 

9 and 

10 (3) by inserting after ""or (h) of this title,” the 

11 rbdouing: "or section. 1030(a)(1), {a)(2)(B} : or 

12 (a)(3) of this title, or is a felony ■violation of section 

13 1030(a)(5) of this title where such violation ox such 

14 section 1030(a5(5) is punishable under clauses (2) 

15 through (v) of section 1030(e)(5)(C) of this title,”. 

1 6 SEC. 4, AMENDMENT TO SENTENCING GUIDELINES. 

17 Section 805(e) of the Antiterronsm and Effective 

18 Death Penalty Act of 1938 (Public Law 1(54-132; 28 

19 U.S.C. 994 note) is amended by striking "paragraph. (4) 

20 cr (5}“ and inscrdag "paragraph (1) cr a filer.;* \f 

2 1 of paragraph (5) ( A) ” . 
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i) 


May 4, 2000 


Re: HiGH TECH CRIME LEGISLATION 

TLU LEGISLATIVE PROPOSALS 


' ' This is to alert you to the on-going efforts of the Technology Law 

Unit in assisting OPCA in addressing the FBI's criminal legislative needs relating to 
computer and Internet investigations as well as responding to issues generated by 
various legislative proposals being submitted by members of Congress. 

Attached are a series of documents which may be broken down 
into two (2) groups: 1 ) Amendments (with legal analysis) which the FBI supports to 
existing bills currently filed and under consideration, and; 2) Proposed amendments the 
subject matter of which is not currently proposed bill Some significant portions of these 

materials represent adaptations of proposals we support and which have been - — 

hammered out with CCIPS over the past several months. We understand from CCIPS 
that most of these proposals have been approved by the administration to be “shopped 
around" and CCIPS is generally aware of our providing technical drafting assistance and 
commentary to the staffs of members of Congress. This has been a time-intensive 
process which has absorbed significant TLU resources with regular assistance from 1LU 
. and is expected to continue until the end of the current legislative session. 


In addition, this is to alert you that TLU’sl^^^^^_„, 
ril! be accompanying OPCA on Thursday, May 4 , 2000 and Friday 
to meet with Senator Hatch's staff and Senator DeWine's staff regarding high tech 
issues and FCC merger approval deadline issues (S.467) respectively. 


Patrick W. Kelley 
Deputy General Counsel 


1 * Mr. Collinowo od 
1 



1 - Mr. Stei 
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PRIORITY OF MATTERS CONTAINED 
IN BELLS CURRENTLY UNDER CONSIDERATION. 


1) Support funding for Technical Support Center and Regional Computer Forensic 
Laboratories. (Hatch) 

2) “Tweaking’"' of language in the amending Pen Register/Trap and Trace Statute, 
(Kyl/Schumer) 

3) ' “Tweaking” of language amending the Computer Fraud Statute. " 

(Kyl/Schumer and Hatch) 

4) Oppose Expansion of Secret Service 18 U.S.C, §1030 jurisdiction. (Hatch) 


l 
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MATTER CONTAINED 


Support funding for Technical Support Center and Regional 
Computer Forensic Laboratories 


1 
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MATTER CONTAINED 

IN BILLS CURRENTLY UNDER CONSIDERATION 


L “Support funding for Technical Support Center and Regional Computer Forensic 
Laboratories” 
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Support For Direct Funding to the FBI for tire 
National Cyber-Crime Technical Support Center 

The FBI strongly supports without reservation the provisions of section 109(a) of S.2448 
as a necessary and critical element in United States’ strategy to combat cyber-crime on a national 
and international level. The absence of adequate technical resources dedicated to the assistance 
of law enforcement in this arena undermines daily the investigative efforts of federal, state and 
local law enforcement officers dedicated to addressing the most troubling aspects of computers 
and the Internet such as chSd sexual exploitation, the dissemination of child pornography, the 
wholesale theft of intellectual property, the theft and disclosure of valuable trade secrets as well 
as countless more traditional crimes now being facilitated by the use of computers. The FBI’s 
existing technical expertise, established with the FBI Laboratory Divisions ’s Engineering 
Research Facility, demonstrates the prudence in providing funding dedicated for these expressed 
purposes directly with the Director of the FBI as the most effective means of ensuring that such a 
facility is constructed and made operational with the least delay possible. Senate Bill 244S's 
approach is necessary, prudent and expeditious. 


1 
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Support for Direct Fundiag to the FBI for the Creation of 
Regional Computer Forensic Laboratories 


The FBI also supports without reservation the provisions of section 109(b) of S. 2448 
authorizing direct funding to the FBI for the express purpose of creating up to ten (10) Regional 
Computer Forensic Laboratories (RCFLs). 

The FBI notes that, by separating Binding for RCFLs under section 1 09(b) of S . 2443 
from State Binding for task forces and other DOI controlled investigative initiatives under 
109(c), the bid implicitly acknowledges the difference between a true computer forensics 
capability which is and should be an objective, scientific function and a computer investigative 
capability 1 , and have appropriately chosen to lodge responsibility for the former with tbeFBI 
through its laboratory division. 

It is well known that the FBI Laboratory Division was instrumental in the development 
and realization of a Regional Computer Forensic Laboratory in San Diego, California at which 
federal, state and local law enforcement officers work side by side sharing both expertise and 
expensive equipment and software vital to the forensic recovery of often critical criminal 
evidence from computers and other digital media. The FBI Laboratory utilized its own financial 
resources to make the San Diego RCFL a reality and is providing extensive computer forensic 
training to state mid local officers of that facility both at the FBI Academy and through computer 
industry recognized training programs. The FBI Laboratory Division now has some twenty (201 
years experience k the science of computer forensics through its Computer Analysis Response * 
Team (CART). With CART scheduled to expand from its current forensic complement of over 
120 examiners to over 300 by the beginning of 2002 (which will continue to secure its place as 
the single largest computer forensic entity k the world), it only makes good sense to harness the 
m s expertise and knowledge of scientific method and forensic “best practices” as the means of 
jump starting a legitimate state and local computer forensic capability. 'The key to the success of 
the San Diego RCFL will be the key to success for future RCFLs, namely the ability to move 
quickly with a minimum of administrative expense, overhead or red tape* S.2448's direct 
funding appropriation make this possibility a reality. 

_ For these and many other reasons, the FBI strongly supports the allocation of direct 
funding for RCFLs to the FBI. 


A Computer investigate capability typically requires specially trained officers who arc versed in Internet 
culture. Internet-based poaa said cthe fraud schemes as well as Internet chat vernacular enabling them to go on-line 
undercover to detect and investigate criminal behavior. In comparison, the locus of a computer forensics capability 
is t he recovery, extraction, interpretation and stabili&ukin of digits evidence, usually from digital stora ge media 
such as a computer hard drive seized as a result of a computer in vestigation. Computer forensic examiners tvpicallv 
are required to possess and master a tar more detailed knowledge of electronics, computer hardware assembly and ’ 
operation and software programing and operation than would be necessary for a computer investigator. A comouter 
forensic faerhty is more detached from heat of the mvestigatba and employs scfctairically proven or acceowd * 
methodologies to recover either inculpatory or exculpatory evidence from a digital medium. 
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MATTER CONTAINED 


'TweaMng” of language in the amending Pen Register/Trap and Trace Statute, 
(Kyi/Schumer) 
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Amendments to the Pen Register and Trap & Trace Statitte 


It is suggested that the last sentence of the proposed modification of 18 U.S.C. § 
3 122(a) (and its legislative history) be changed to make dear that service of the new single, 
nation-wide court order is not required upon all providers in the communication chain ifa single 
provider has access to ail transmission data. The suggested change is: 


9 

11 



13 

IS 


17 


19 

21 


It Is also suggested that the proposed revision to 3 123 subsection (b) (1), new 
subparagraph (C) be changed for the reasons stated below in the proposed legislative history: 

“(C) a description of — 

, the fcg§mc|i nahme of tp;Communicafions to which the order applies, 

sdpras)y ific!udin g-the number or other identifier 5 * 


23 


25 

27 

29 

31 

33 

35 

37 

39 


41 


Proposed Legislative History 

Existing Subsection (C) is intended to require the identification of the “facility” to which the pen 
register or trap and trace is applied. Historically this was accomplished by Identifying the 
telephone number of the targeted telephone, and if known the physical location of that telephone. 
W ith the increase in electronic communications via e-mail, chat sessions, instant Messaging, or 
telenet sessions, it may not always be possible to identity a static “facility.” In cases of dynamic 
addressing of Internet accounts and telenet sessions for example, it is difficult to describe the 
facility through a static number. To address this, the statute should permit the applicants to 
describe the technical nature of the communications as a means of further identifying the facility 
to which the order applies. Examples might include the computer protocol or computer language 
utilized, or any dynamically assigned message identification number or code or part thereof" 

The bill also inserts “routing, addressing” into the phrase “dialing and signaling information” in 
section 3 121(c) and other provisions of the statute. The term “signaling” has historically been 
given an expansive reading to include, in the electronic communications world (e.a., e-mail) 
much of what would be “routing and addressing” and then some. It is stressed that the insertion 
and existence of “routing, addressing” into the statute is not intended to limit the interpretation 
of t he term "signalirig/’ 


Pen ResisicrlVap Trarc Amendments 
Page l of i Pagtis 
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MATTER CONTAINED 
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Counting Prior State Computer Crime Offenses: 


A new § I030(e)(3 0) would define conviction to include prior Federal juvenile 
adjudications for violations of § 1030. Given that the majority of States now have unauthorized 
computer access or similar computer crime statutes 2 , it is suggested that the proposed new 
definition of conviction be further expanded to include prior State computer convictions. The 


' 2 Some 45'States have enacted statutes prohibiting, to varying degree, computer crime: 
AL Computer Crime Act, Code of Alabama, Sections 13A-8-lG0to 13A-8~103- AK Statutes 
Sections 11.46.200(a)(3), 11. 46.484(a)(5), 11.46.740, 11.46.985, 11.46.990; AZ Revised ' 
Statues Annotated, Sections 13-2301(E), 13-2316; CA Penal Code, Section 502; CO Revised 
Statutes, Sections 18-5.5-10.1, 18-5.5-102; CT General Statutes, Sections 53a-25G to 53a*261 
52-570b; DH Code Annotated, Title 1 1, Sections 931-938; FI Computer Crimes Act, Florida 
Statutes Annotated, Sections 815.01 to 815.07; GA Computer Svstems Protection Act Georgia 
Codes Annotated, Sections 16-9-90 to 16-9-95; HI Revised Statutes, Sections 708-890 to 780- 
896; ID Code, Title 18, Chapter 22, Sections 18-2201, 18-2202; H Annotated Statutes 
(Criminal Code), Sections 15-1, 16-9; IN Code, Sections 35-43-1-4, 35-43-2*3; IO Statutes, 
Sections 716A. 1 to 716A.16; KS Statutes Annotated, Section 21-3755; KY Revised Statutes 
Sections 434.840 to 434.860; LA Revised Statutes, Title 14, Subpart D. Computer Related 
Crimes, Sections 73. 1 to 73.5; ME Revised Statutes Annotated, Chapter 15, Title 17-A, Section 
357; MD Annotated Code, Article 27, Sections 45A and 146; MA General Laws, Chapter 266 
Section 30; MI Statutes Annotated, Section 28.529(])-{7); MN Statutes (Cranbal Code), 
Sections 609.87 to 609,89; Ml Code Annotated, Sections 97-45-1 to 97-45-13; MS Revised 
Statutes, Sections 569.093 to 569.099; MT Code Annotated, Sections 45-2-101, 45-6-310 45- 
6r J 1 1 , NE Revised Statutes, Article 13{p) Computers, Sections 28-1343 to 28-1348' NV 
Revised Statutes, Sections 205.473 to 205.477; NH Revised Statutes .Annotated, Sections 
638. 16 to 638:19; NI Statutes, Title 2C, Chapter 20, Sections 2C.20-1, 2C;20-23 to 2C:2G-34 
and Title 2A, Sections 2A.38A-1 to 2A:3SA-3; NM Statutes Annotated, Criminal Offenses 
Computer Crimes Act, Sections 30-16A-1 to 30-16A-4; NY Penal Law,' Sections 1 55 00 ’ 
156.00 to 156.50, 165.35 subdiv. 10, 170.00, 175.00 NC General Statutes, Sections 14-453 to 
14-457; ND Century Code, Sections 12.1-06.1-01 subsection 3, 12.1-06. 1-08- OH Revised 
Code Annotated, Sections 2901.01, 2913.01, 2913.04, 2913.81; OK Computer Crimes Act 
Oklahoma Session Laws, Title 21, Sections 1951-1956; OR Revised Statutes, Sections 164325 
! 64,377; PA Consolidated Statutes Annotated, Section 3933; Ri General Laws (Criminal 
Offenses), Sections 11-52-1 to 11-52-5 SC CodeofLaws, Sections 16-16-10 to 16-16^0 SD 
Codified Laws, Sections 43-43B-1 to 43-43B-8; IN Code Annotated, Computer Crimes Act 
Sections 39-3-1401 to 39-3-1406; TX Codes .Annotated, Title 7, Chapter 33, Sections 33 'oi’to 
33.05; UT Computer Fraud Act, Utah Code Annotated, Sections 76-6-701 to 76-6-704: VA 
Computer Crime Act, Code of Virginia, Sections 18.2-152.1 to 38 2-152 14- WA Revised Code 
-Annotated, Sections 9A.4S. 100, 9A.52.010, 9A.52. 1 10 to 9A.52, 130 W1 Statutes Annotated 
Section 943.70; WY Statutes, Sections 6-3-501 to 6-3-505, 

Suggested Additional Amendments to Computer Fraud m& Abuse Act 
Page 1 of: Pages 
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suggested additional language to the proposed bills’ § 1 03O(e)(lO) version would be: 


3 

5 

7 


and 

(B) a conviction under the law of anv State for a crime punishable hv 
imprisonment for more than 1 year, an element of which is unauthorized 
access, or exceeding authorized access, to a computer.” 


Given the fact that most section 1030 offenders are juveniles and statistically 
more likely to first receive State juvenile abdications, it is further recommended that the 
provision go even gather than that outline above by including prior State juvenile adjudications. 


13 

15 

17 


19 


21 

23 

25 

27 


Expanding the Definition of ‘loss” to Include Preventative Reconfiguration: 

Another recommendation for the Hatch BilHs that the proposed definition of 

"loss" in Section 1030(e)(l 1) be made clearer to include the cost of plugging holes in computer 
defenses as a means of preventing future attacks--so called "preventative re- ; 

conjiguration'reprogranimirig." The new language could read: 

“(] 0 the term “loss” means any reasonable cost to any victim, including the cost 
of responding to an offense, conducting a damage assessment, implementation of 
responsive security measures or r^Qnfisiir<ittDn resson&blyrcsiculflted to prevent 
&ture .damage, and restoring the data, program, system, or Information to Sis 
condition prior to the offense, and any revenue lost, cost incurred, or other 
consequential damages incurred because of mtemiptlon'of service;"' 


29 


Suggested Additional Amendments to Computer fraud m4 Abuse Act 
Page 2 oil Pages 


5/24/02 Release - Page p 22 




MATTER CONTAINED 

IN BILLS CURRENTLY UNDER CONSIDERATION 


Oppose Expansion of Secret Service 18 U.S.C. §1030 jurisdiction. 


X 
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Executive Summary 




Basis of Opposition to Amendment to Grant Concurrent Jurisdiction to the United States 

Secret Service in Section 1030 Offenses. 

The proposed amendment to section 1030(d) of Tide 18 would grant concurrent 
jurisdiction to the United States Secret Service (USSS) to investigate all crimes found in Section 
1030. 


In 1996, Congress specifically iimitpd the Secret Service’s authority to investigate crimes 
under IS U.S.C. § 1030 to only those offenses under subsections (a)(2)(A) and (B), (a)(3), (a)(4), 
(a)(5) and (a)(6). The Senate Report accompanying the 1996 amendment explained that: 

ftjhe new crimes proposed in the bill, however, do not fail under the Secret 
Service’s traditional jurisdiction. Specifically, proposed subsection 1030(a)(2)(C) 
addresses gaps in 18 U.S.C, 23 14 (interstate transportation of stolen property), 
and proposed section 1030(a)(7) addresses gaps in 18 U.S.C. 1951 (the Hobbs 
Act) and S75 (interstate threats). These statutes are within the jurisdiction of the 
Federal Bureau of Investigation, which should retain exclusive jurisdiction over 
these types of offenses, even when they are committed by computer. 

S, Rep. No. 357, 104th Cong., 2d Sess. 13 (1996). 

Inherent in the 1996 changes was the recognition that the statute was being amended to 
reflect the respective investigati ve jurisdictional limits existing at that time. It was dear at that 
time, that the jurisdiction of the Secret Service, found at 18 U.S.C. § 3056, did not encompass 
the types of offenses described in Section 1030 (aXi), (a)(2)(C), or (a)(7). 3 Given that there 
have been no additional grants of investigative jurisdiction to the USSS since that amendment, 
the current proposal to grant jurisdiction to the USSS is at best questionable. The theft of 
National Security' information which is the type of information Section 1030(a)(1) was intended 
to address has never been the subject of USSS jurisdiction, nor should it be. In addition, the 
U'pes of crimes contemplated by 1030(a)(2)(C) and (a)(7), as recognized by the legislative 


3 *Un<fef the direction of the Secretly of the Treasury, the Secret Service is authorized to detect and arrest any 
person who violates - 

O ) section 50$, 509 1 5 10, S7 1 , or $79 of this title or, with respect to the Federal Deposit Insurance Corporation, 
Federal land banks, and Federal land bank associations, section 213. 216,433, 493, 657> 709, 1006 1007 $01 1 101 3 $014 
1907, or 1909 of this tide; 

(2) any of the laws of the United States relating to coins, obligations, and securities of the United States and of Iordan 
governments: or 

(3 ) any of the laws of the United Sta tes relating to electronic fond trans fer frauds, credit and debit cord frauds, an d 
false identification documents or de vices; except that the authority conferred by this parag raph s hall be exerc i sed subject tot he 
agreement of the Attorney General and the Secretary of the Treasury and shall not affect the authority of any other Federal law 
enforcement agency with respect to those law s. 

Basis of Opposition to Expanded Secret Service Jurisdiction under 18 U.S.C. §1030 

Page 1 of 2 Pages 
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history, have traditionally been investigations solely k the province of the FBI. 


The 1996 provision is an explicit effort by Congress to address the criminal offenses at 
i ssue through a di vision of labor primarily determined by investigative responsibility and 
expertise. Any reversion to the pre- 1996 jurisdictional provisions raises serious issues and 
concerns about the utilization of resources. Concurrent jurisdiction will result in a duplication of 
efforts that will waste resources and will encourage independent investigations by separate 
agencies at the expense of coordinated joint efforts. " r 


Basis ot Opposition to Expanded Secret Service Jurisdiction under 18 U.S.C. §1030 

Page 2 of 2 Pages 
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MATTER NOT CONTAINED 
IN BILLS CURRENTLY UNDER CONSIDERATION. 

Cable Communications Act amendment. 
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Executive Summary 

Cable Communications Policy Act Amendment 


The Cable Communications Policy Act, passed in 1984 to regulate various aspects of the 
cable television industry, did not take into account the changes in technology that have occurred 
over the last fifteen years. Cable television companies now often provide Internet access and 
telephone service in addition to television programming. This amendment clarifies that when a 
cable company acts as a telephone company or an Internet service provider, it must comply with 
the laws governing the interception and disclosure of wire and electronic communications just 
like any other telephone company or Internet sendee provider. 


Cable Communications Policy Act Amendment 
Page I of 6 Pages 
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UNITED STATES CODE ANNOTATED 
TITLE 47. TELEGRAPHS, TELEPHONES, AND RADIOTELEGRAPHS 
CHAPTER 5-WIRE OR RADIO COMMUNICATION 
SUBCHAPTER VAC-CABLE COMMUNICATIONS 
PART ^-MISCELLANEOUS PROVISIONS 


Section 551. Protection of subscriber privacy 

(a) Notice to subscriber regarding personally identifiable information; definitions 

(1) At the time of entering into an agreement to provide any cable service or other service 
to a subscriber and at least once a year thereafter, a cable operator shall provide notice in 
the fontt of a separate, written statement to such subscriber which clearly and 
conspicuously informs the subscriber of— 

(A) the nature of personally identifiable information collected or to be collected 
with respect to the subscriber and the nature of the use of such information; 

(B) die nature, frequency, and purpose of any disclosure which may be made of 
such informatio n, including an identification of the types of persons t o whom the 
disclosure may be made; 

(€) the period during which such information will be maintained bv the cable 
operator, 

OD) the times and place at which the subscriber may have access to such 
information in accordance with subsection (d) of this section; and 
(E) the limitations provided by this section with respect to the collection and 
disclosure of information by a cable operator and the right of the subscriber under 
subsections (I) and (h) of tnis section to enforce such limitations. 

In the case of subscribers who have entered into such an agreement before the effective 
date of this section, such notice shall be provided within 1 SO days of such date and at 
least once a year thereafter. 

(2) For purposes of this section, mher than subsection (h) of this section- 

(A) the term "personally identifiable information" does not include any record of 
aggregate data which does not identify particular persons; 

(B) the term "other service" includes any wire or radio communications service 
provided using any of the tacilities of a cable operator that are used in the 
provision of cable service; and 

(C) the term "cable operator" includes, in addition to persons within the definition 
of cable operator in sect ion 522 of this title, any person who (I) is owned or 
controlled by, or under common ownership or control with, a cable operator, and 
(ii) provides any wire or radio communications service. 


Cubic Co nirnuru cuuoius Act Amendment 
Puge 2 of 5 Pages 
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(b) Collection of personally identifiable information using cable system 

(I) Except as provided in paragraph (2), a cable operator shall not use the cable system to 
collect personally identifiable information concerning any subscriber without the prior 
written or electronic consent of the subscriber concerned. 


(2) A cable operator may use the cable system to collect such information in order to- 

(A) obtain information necessary to render a cable service or other sendee 
provided by the cable operator to the subscriber, or 

(B) detect unautho rized reception of cable communications. 


(c) Disclosure of personally identifiable information 

(!) Except as provided in paragraph (2) s a cable operator shall not disclose personally 
identifiable information concerning any subscriber without the prior written or electronic 
consent of the subscriber concerned and shah take such actions as are necessary to 
prevent unauthorized access to such information by a person other than the subscriber or 
cable operator. 


(2) A cable operator may disclose such information if the disclosure is- 

(A) necessary to render, or conduct a legitimate business activity related to, a 
cable service or other service provided by the cable operator to the subscriber; 

(B) subject to subsection (h) of this section, made pursuant to a court order 
authorizing such disclosure, if the subscriber is notified of such order by the 
person to whom the order is directed; or 


(C) a disclosure of the names and addresses of subscribers to any cable service or 
other service, if-- 

(i) the cable operator has provided the subscriber the opportunity to 
prohibit or limit such disclosure, and 

(ii) the disclosure does not reveal, directly or indirectly, the- 

(I) extent of any viewing or other use by the subscriber of a cable 
service or other service provided by the cable operator, or 

(II) the nature of any transaction made by the subscriber over the 
cable system of the cable operator?! H 


Such disclosure: shall not include records revealing customer cable television 
viewutg activity. For purposes of this section, “customer cable television viewing 
activity" shall mean the cable customer viewing habits of operator-selected, pre-' 


Cable Communications Act Amendment 
Page 3 of 5 Pages 
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3 

(d) Subscriber access to information 
5 

A cable subscriber shall be pro vided access to all personally identifiable information regarding 
7 that subscriber which is collected and maintained by a cable operator. Such information shall be 
made available to the subscriber at reasonable times and at a convenient place designated by 
S such cable operator. A cable subscriber shall be provided reasonable opportunity to correct any 
error in such information. . 

11 ' ' 


1 3 (e) Destruction of information 

15 A cable operator shall destroy personally identifiable information if the information is no longer 
necessary' for the purpose for which it was collected and there are no pending requests or orders 
1 7 for access to such information under subsection (d) of this section or pursuant to a court order. 

19 v 

(f) Civil action in United States district court; damages; attorney's fees and costs; nonexclusive 
21 nature of remedy 


23 

25 

27 

29 

31 

33 


(1) Any person aggrie ved by any act of a cable operator in violation of this section may 
bring a civil action in a United States district court. 

(2) The court may award— * 

(A) actual damages but not less than liquidated damages computed at the rate of 
$100 a day for each day of violation or $1,000, whichever is higher; 

(B) punitive damages; and 

(C) reasonable attorneys’ fees and other litigation costs reasonably incurred. 

( ” } The remedy provided by this section shall be in addition to any other lawful remedy 
available to a cable subscriber. 


3 5 (g) Regulation by States or franchising authorities 

3 7 Nothing in this subchapter shall be construed to prohibit any State or any franchising authority' 

from enacting or enforcing laws consistent with this section for the protection of subscriber 
39 privacy. 


41 

(h) Disclosure of information to go vernmental entity pursuant to court order 
43 
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Except' $s A governmental entity may obtain personally 

identifiable information concerning a cable subscriber pursuant to a court order only i£ in the 
court proceeding relevant to such court order— 

(1) such entity offers dear and convincing evidence that the subject of the information is 
reasonably suspected of engaging in criminal activity and that the information sought 
would be material evidence in the case; and 

(2) the subject of the information is afforded the opportunity to appear and contest such 
entity's claim. 


PROPOSED LEGISLATIVE HISTORY FOR 
AMENDMENTS TO THE CABLE COMMUNICATIONS POLICY ACT 


The Cable Communications Policy Act currently establishes two different sets of rules 
regarding privacy protection and disclosure to law enforcement: one governing cable service 
(“Cable Act”) (47 U.S.C. §551), and the other applying to the use of telephone service and 
Internet access, (the wiretap statute (IS U.S.C §2510 the Electronic Communications 

Policy Act f £CP A”) (IS U.S.C. §2701 et.seg.), and the pen register and trap and trace statute 
(1 8 U.S.C, §3121 gt sgff ). Yet today, unlike in 1984 when Congress passed the Cable 
Communications Policy Act, many cable companies offer not only traditional cable 
programming services but also Internet access and telephone service. The rules governing law 
enforcement access to the records of communication service providers’ customers, however, 
should not depend on whether the customer has chosen to use a cable company or a more 
traditional type of provider for Ids telephone or Internet service. Congress believes that cable 
companies offering such services should comply with court orders and other legal process 
permitted under the wiretap statute, ECPA, and the pen register and trap and trace statute with 
respect to their telephone and Internet customers. 

In recent years, however, cable companies have increasingly balked at complying with 
such process, noting the seeming inconsistency of these statutes with their duty of nondisclosure 
(except under stringent limits) under the Cable Communications Policv Act Seg in re 
Application of United States, 36 F. Sup p. 2d __ (D. Mass. Feb. 9, 1999) (noting apparent 
statutory conflict and ultimately granting application for order under IS U.S.C. 2703(d) against 
cable company providing Internet service). These complications have at times delayed or” 
frustrated investigations. 

In addition, section 551 flawed because it permits law enforcement to obtain 
information only when that information constitutes evidence of an offense. In some cases 
however, the information sought from a service provider 5s not evidence of a crime, even thotmh 
11 he! P s t0 solve one. For example, law enforcement officials may try to arrest a fugitive who is 
accessing his e-mail account from a remote location, and they need to obtain information from 
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the cable company that shows from what location he is accessing that account. Moreover, 
whether law enforcement can obtain a court order to obtain such information should not depend 
on whether the fugitive has chosen to connect to the Internet using a cable company instead of a 
traditional Internet service provider. 


Accordingly, the amendment inserts a new subsection 55 1(c)(2)(D) to confirm that cable 
companies, like other providers, remain subject to ECPA, the wiretap statute, and the trap and 
trace statute with respect to the provision of telephone and Internet services, notwithstanding 
section 551. The definition of B customer cable television viewing activity” is intended to 
exclude from disclosure under chapters 1 \% 121, or 206 of title 18 of the United States Code 
traditional cable and broadcast television video/audio presentations Unlike Internet video 
presentations, the subject content and timing of which are selected by the cable customer, the 
selection and timing of television presentations are controlled by the operator. The disclosure 
exclusion is not intended to encompass or prohibit the disclosure by an operator of records or 
formation relating to television presentations which are re-transmitted through the Internet. 
Records relating to such re-transmissions would be treated like all other Internet-related records 

Tr S ai f r f ii9, !21, or 206 oftit3e 3S - The amendment, however, is intended to preserve 
me Cable Act’s primacy with respect to records revealing what ordinary cable television 
programing a customer chooses to purchase, such as particular premium channels or “pay per. 
view shows. Thus, in a case where a customer receives both Internet access and conventional 
cable television service from a angle cable provider, a government entity can compel disclosure 
under ECPA only those customer records relating to Internet service. 
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Executive Summary 

Necessary Amendments to the Privacy Protection Act - 42 U.S.C. § 2060aa, el seq. 

. . The pnvae y Protection Act (PPA) prohibits law enforcement from searching for or 

seiang work product materials or documentary materials possessed by a person in connection 

wt 3 P ur P ose to disseminate them to the public in a newspaper, book, broadcast, or other 

srnii ar form of public communication. Originally adopted to prevent the search of third party 

news-gathers m traditional media (e.g., newspaper press rooms, tv editor offices), the PPA has 

generated unforseen obstacles for law enforcement when applied to the search of a criminal’s 

personal computers tf the computers coincidentally are being used for web site publishing A 

scenario frequently encountered by law enforcement involves the seizure of a computer used to 

disseminate child pornography which may coincidentally also control the e-mail and/or websites 

ot the suspect and third parties. Because of the size of modem personal computer hard dri ves 

cjday most computers cannot effectively be searched on scene, but are usually seized &$t then 

searched later m a computer forensic environment as expressly provided for by a magistrate 

Unfortunately, such a practice creates a dilemma for investigators who may 

plater diirntg tHe exammatIon P rocess Potential third party news gatherer material may' 

„ he C ? mp T 6r SySie f' The reaHz2t!0n TOa >' be t0 ° 1ate as the PPA prohibits both search 

and seizure of such material. 

_ , Amendments detailed herein would carve out a reasonable exception to the Act when the 

search or seizure of work product materials or documentary materials is incident al to” the 

dnwr f S6 Tc 0 5 0th t re y idefiC€ rdevant t0 3 erime - ^us, the seizure of a computer hard 
m^t, th f d part> ' for eV5dsnce of child pornography would not be prohibited 

S4edT S th^PpT e hard drfVe COnt;Uaed W ° rk Pr ° duct ° r 0ther d0CU! ^ e "^y material 
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X [redime strikeou t version of amendments to the Privacy Protection Act] 

3 UNITED STATES CODE ANNOTATED 

TITLE 42. THE PUBLIC HEALTH AND WELFARE 
5 CHAPTER 21A~PRIV'ACY PROTECTION 

SUBCHAPTER I-FIRST AMENDMENT PRIVACY PROTECTION 
7 - ,, PART A-JUNLAWFUL ACTS 

9 Section 2000aa. Searches and seizures by government officers and employees in connection with 

investigation or prosecution of criminal offenses 

11 


13 


(a) Work product materials 


15 
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i notwithstanding any other law, it shall be unlawful for a government officer or employee in 
connection with the investigation or prosecution of a criminal offense, to search for or seize any 
work product materials possessed by a person reasonably believed to have a purpose to 
disseminate to the public a newspaper, book, broadcast, or other similar form of public 
communication, in or affecting interstate or foreign commerce; but this provision shall not 
impair or affect the ability of any government officer or employee, pursuant to otherwise 
applicable law, to search for or seize such materials, if- 

(!) there is probable cause to believe that the person possessing such materials has 
committed or is committing the criminal offense to which the materials relate: Provided 
however. That a government officer or employee may not search for or seize such 
materials under the provisions of this paragraph if the offense to which the materials 
relate consists of the receipt, possession, communication, or withholding of such 
materials or the information contained therein (but such a search or seizure may be 
conducted under the provisions of this paragraph if the offense consists of the receipt 
possession, or communication of infoimation relating to the national defense, classified 
information, or restricted data under the pro visions of section 793 , 794 , 797 or 79 $ 0 f 
Title 38, or section 2274, 2275 or 2277 of this title, or section 783 of Title 50 or "if the 
offense involves the production, possession, receipt, mailing, sale, distribution,’ shipment 
or transportation of child pornography, the sexual exploitation of children, or the sale or’ 
purchase of children under section 2251, 2251 A, 2252, or 2252A of Title 18); m 

( 2 ) there is reason to believe that the immediate seizure of such materials is necessary' to 
prevent the death of or serious bodily injury to, a human being-fgr 

^execution of 
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(b) Other documents 

Notwithstanding any other law, it shall be unlawful for a government officer or employee, in 
connection with the investigation or prosecution of a criminal offense, to search for or seize 
documentary materials, other than work product materials, possessed by a person in connection 
with a purpose to disseminate to the public a newspaper, book, broadcast, or other similar form 
of public communication, in or affecting interstate or foreign commerce; but this provision shall 
not impair or affect the ability of any government officer or employee, pursuant to otherwise 
applicable law, to search for or seize such materials. If— 


(1) there is probable cause to believe that the person possessing such materials has 
committed or is committing the criminal offense to which the materials relate; Provided, 
however, That a government officer or employee may not search for or seize such 
materials under the pro visions of this paragraph if t he offense to which the materials 
relate consists of the receipt, possession, communication, or withholding of such 
materials or the information contained therein (but sucb a search or seizure may be 
conducted under the provisions of this paragraph if the offense consists of the receipt, 
possession, or communication of information relating to the national defense, classified 
information, or restricted data under the provisions of section 793, 794, 797, or 798 of 
Title 18, or section 2274, 2275, or 2277 of this title, or section 783 of Title 50, or if the 
offense involves the production, possession, receipt, mailing, sale, distribution, shipment, 
or transportation of child pornography, the sexual exploitation of children, or the sale or 
purchase of children under section 2251, 2251 A, 2252, or 2252.4. of Title 18); 

(2) there is reason to believe that the immediate seizure of such materials is necessary to 
prevent the death of, or serious bodily injury to, a human being; 

(3) there is reason to believe that the giving of notice pursuant to a subpoena duces tecum 
would result in the destruction, alteration, or concealment of such materials; of 

(4) such materials have not been produced in response to a court order directing 
compliance with a subpoena duces tecum, and** 

(A) all appellate remedies have been exhausted; or 

(B) there is reason to believe that the delay in an investigation or trial occasioned 
by further proceedings relating to the subpoena would threaten the interests of 
justicerv:§| 


< 5 ) illiMrif: pr examination of documentary materials is incidental to the.execation of 




(c) Objections to court ordered subpoenas; affidavits 
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In the event a search warrant is sought pursuant to paragraph (4)(B) of subsection ( b) of this 
section, the person possessing the materials shall be afforded adequate opportunity to submit an 
affidavit setting forth the basis for any contention that the materials sought are not subject to 
seizure. 
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PROPOSED LEGISLATIVE HISTORY FOR 
AMENDMENTS TO THE PRIVACY PROTECTION ACT 

^ The Privacy Protection Act of 1980 ("PPA"), 42 U.S.C. § 20OOaa, et scq .. makes it 
unlawful for local, state, or federal law enforcement authorities to "search tor or seize any work 
product material d' or any “documentary materials ... possessed by a person in connection with a 
purpose to disseminate to the public a newspaper, book, broadcast, or other similar form of 
public communication.’* 42 U.S.C. § 2000aa(a), .(b), Use statute defines "work product 
materials" as materials prepared or possessed in anticipation of communicating such materials to 
the public, except .if the materials constitute contraband or the Suits or instrument alities of crime. 
M. § 2OQ0aa~7(b), "Documentary materials," on the other hand, consist of materials upon which 
information is recorded, once again with the exception of contraband and the fruits or 
instrumentalities of crime. Id. § 200Oaa-7(a). Thus, other than for the exceptions, the PPA 
effectively imposes a "no-search" rule on work product materials and a "subpoena-first" rule on 
documentary materials held by third parries who plan to use them to communicate to the public. 
Although the statute appears reasonable on its face, its application in the current electronic 
environment has inadvertently shielded criminal activities from legitimate law enforcement 
investigations, such efforts to arrest and prosecute those who distribute child pornography over 
the Internet. 


( a ) Intent of the PPA 

Congress passed the PPA in response to the Supreme Court’s decision in Zurcher v. 
Stanford , Pal l y , 436 US. 537 (1978). In Zurcher, the Supreme Court upheld a police search, 
pursuant to a valid search warrant, of the offices of The Stanford D aily newspaper for 
photographs taken at the scene of a crime. The Court rejected the newspaper's claim that search 
warrants eoujdnot be used to recover evidence from those engaging in Tint Amendment- 
protected activities. Id at 565-567. The Court also held that law enforcement officers could use 
search warrants m recover evidence from innocent third parties. Id. at 555 ("state's interest in 
enforcing the criminal law and recovering evidence is the same whether the third party is 
culpable or not"). The Court concluded, therefore, that “the critical element in a reasonable 
search is not that the owner of the property is suspected of a crime but that there is reasonable 
cause to believe that the specific 'things' to be searched for and seized are located on the property 
to which entry is sought” Id. at 556. 

In response to the Court's ruling. Congress passed the PPA. Congress intended to restrict 
searches for mere evidence of crime held by innocent third parties who were engaged in First 
Amendment-protected activities — evidence that law enforcement officials might otherwise 
obtain through less intrusive means, such as by issuing a subpoena. The purpose of restricting 
law enforcement in this fashion, of course, was to protect the confident iality of non-evidentiary 
files also held by this special group of innocent third parries — both the drafts of art icles not yet 
published and the research and other supporting information (e.g., notes and interviews) which 
they never intended to publish. Thus, the PPA protects an author or publisher (like The Stanford 
Daily) — who is not a suspect in the investigation — from law enforcement attempts to. search 
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through Ms or her work product or documentary materials in order to find and seize evidence. 

To preserve the confidentiality of these designated materials, the PPA instructs investigators not 
to search for the evidence at ail, hut to compel the innocent third parties to find and produce it 
themselves. This goal of Congress remains unchanged, and our amendments do not alter this 
protection for innocent third parties. 

Congress never intended, however, to protect criminals from court-authorized searches, 
and the legislative history to the PPA is replete with statements to this effect. For example, the 
Senate Judiciary Committee Report stated that the purpose of the PPA is to "limit searches for 
materials held by persons involved in First Amendment activities who are themselves not 
suspected ofparrieipation in the criminal activity for which the materials are sought." $. Rep. 

No, 96-874, 96th Cong., 2d Sess. 1 1 (19S0), reprinted in 1980 U.S.C.C.A.N. 3950, 3957 
(emphasis added). Moreover, the Committee Report stated that the intention in enacting the PPA 
was "not to limit the ability' of law enforcement officers to search for and seize materials held by 
those suspected of committing the crime under investigation." M. Indeed, the lan gu age of the 
statute itself allows searches and seizures of any person who “has committed or is committing 
the criminal offense to which the materials relate” 42 U.S.C.A. § 2000aa(a){l), (b)(1). Plainly, 
Congress had no desire to inhibit law enforcement investigators that need to search the premises 
of a suspected wrongdoer. 


item of commingling of protected documents and evidence 


Because Congress enacted this statute before the widespread proliferation of computers, 
it could not fully consider the problem raised by the commingling of protected information and 
contraband, .Although commingling can, of course, occur with paper records — for example, if a 
reporter engaging in tax fraud placed a copy of the fraudulent tax return in a filing cabinet with 
his or her work-related notes — such commingling never presented a significant problem for two 
reasons. First, the statute applied only to members of the traditional media, a limited group not 
usually associated with committing crimes. Second, when searching for paper records, 
investigators can generally examine records on site and then seize only those records that are the 
subject of their warrant. Thus, investigators can avoid violating the PPA by not “searching for” 
or “seizing" any protected material since they do not need to cany away anythin e but the object 
of their search." 


With the widespread use of computers and the Internet, however, both of these limiting 
factors have disappeared. First, every computer user has become a potential publisher. For 
example, a single computer can provide (I) an electronic “bulletin board" for the posting of news 
items by individuals using the Internet; (2) user accounts where private individuals can store 
drafts of news items that they intend to post on the “bulletin board"; and (3) a website from 


Of course, investigators may briefly isolate or possess protected material during 
the execution of the warrant, but such possession occurs during the execution of every search" 
warrant and does npt constitute a seizure. 
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which anyone with access to the Internet could view or download child pornography. Although 
the second category of data arguably constitutes “work product” under the PPA, 5 law 
3 enforcement officials plainly have the duty to search for and seize the third category of data, 

5 Second, potential liability under the PPA may arise for law enforcement officials in such 

a scenario because it has become both unreasonable and impractical and in some instances 
7 technically impossible to search for and seize the contraband without simultaneously seizing 

protected material. In the new electronic environment, where computer systems with gigabytes 
9 of storage have become ubiquitous, law enforcement agents generally cannot extract legally 

seizable evidence from commingled protected material without actually seizing, at least 
11 temporarily, those protected materials, or, perhaps more intrusively, without moving into and 
occupying the search premises for extended durations. Because of the volume of data to be 
13 searched or because of technical concerns (e.g. encryption), law enforcement agents must very 
often remove the seized computer or an exact copy of aB the data to a laboratory for analysis. 

15 

Moreover, liability may attach In such cases because the prohibition on searching for or 
1 7 seizing materials is stated in the disjunctive; violations may lie either for searching for or 
seizing such materials. Thus even a temporary seizure or examination may result in liability', 

19 despite the fact that such a PPA violation lies far outside the scope of the issues raised by the 
Zurcher decision. Zurcher involved a search of a newspaper office, and the warrant was drawn 
21 to intentionally seize photographs that had been made in contemplation of publicat ion. The 

PPA, designed to address the Zurcher decision, accordingly should deter law enforcement from 
2 3 intentionally searching for evidentiary materials in the possession of innocent third parties 

engaged in information dissemination. But making unlawful the reasonable but incidental 
2 5 seizure of PPA-protected materials pursuant to an otherwise lawful search or seizure carries no 

similar deterrent effect, and it contravenes the clearly stated intent of Congress to neither shield 
27 criminals nor unduly hinder law enforcement efforts. 

2 9 (c) Problems faced by law' enforcement 

3 1 The potential — and unpredictable — liability inadvertently created by the PPA has 

inhibited the investigation and prosecution of crimes committed using computers. For example, 

3 3 individuals have used computers to distribute child pornography, copyrighted software, and 

stolen credit card numbers over ordinary phone lines and the Internet. Some of these individuals 
3 5 have attempted to use the PPA to shield their illegal activities by intentionally storing PPA- 

protected materials on the same storage devices that they use for their illegal activities. Indeed, 

3 7 law enforcement agents have encountered individuals using computers for illegal activities that 
have posted the following message on their sign-on screens: 


No court has vet held that an electronic message, posted for viewing by the general public bv way 
of a Bulletin Board System or the Internet, constitutes a “similar torn of public communication* to newspapers, 
books, and broadcasts under the PPA. Although the instant amendments to the PPA do not opine on this subject, a 
court might make this ruling if presented with the right facts 
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NOTICE TO LAW ENFORCEMENT AGENTS: 

The owners and users of this system are exercising First Amendment Rights 

Some material on thus system is in preparation for public dissemination and is 
"work product material" protected under the First Amendment Privacy Protection 
Act of 1980 .... Each and every person who has such "work product material" 
stored on this system is entitled to recover at least minimum damages of $1000 

*plus all legal expenses* While the agency you work for * might* pay your 

legal fees .and judgments against you, why take chances? 


The language "[sjorae material on this system" is extremely significant. It is seldom the case 
that a computer is used solely for illegal purposes such as the distribution of contraband. Were 
this the case, the computer and the evidence it contains could be seized without regard to the 
PPA, since contraband is specifically excluded from the definitions of work product and 
documentary materials. 42 U.S.C. § 2Q0Gaa-7(a) (defining "documentary materials"); 42 U.S.C. 
§ 2000aa-7(b) (defining "work product materials"). In most cases, only certain portions of a 
website or electronic bulletin board will be set aside for illegal activities, while other portions are 
used for completely legal activities such as the legitimate distribution of information. As the 
quoted language makes clear, however, criminals are well aware that under the PPA, protected 
materials can be used to shield contraband from search and seizure. Congress, of course, never 
intended to shield contraband when it enacted the PPA. 

Moreover, in addition to exposing law enforcement to unintended liability, the PPA, as it 
stands, creates unnecessary problems during the execution of warrants, problems that potentially 
harm the health and safety' of the public. In 1999, for example, Special "Agents of the Federal 
Bureau of Investigation uncovered a system of computers used to proride child pornography to 
anyone with access to the Internet. These computers, however, also provided Internet accounts 
to third parties, many of whom did not know about the illegal activities of the computers’ 
operators. These unrelated accounts may have contained material protected by the PPA. The 
investigators determined that it would be impossible to search the computers on site while at the 
same rime allowing the computers to continue to operate. Thus, in an effort to reduce their 
potential liability under the PPA for seizing the third party accounts, the investigators decided to 
obtain a search warrant authorizing them only to copy the computers’ stored data and allow the 
computers to continue to operate. This, of course, had the effect of allowing the child 
pornography to remain accessible to the public — and possibly even allowing the pomographers 
or their confederates to copy the images to an unknown computer — while computer experts 
reviewed the data to segregate the illegal files. Congress never intended to hamper law 
enforcement efforts in this way. 


41 (d) The solution 


43 


While the PPA must be amended so that it does not shield child pomographers, 
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copyright infringers, and other criminals, such amendments should not inhibit those activities 
that the PPA was designed to protect. Indeed, the importance of protecting the confidentiality of 
these sensitive materials remains as great today as it has ever been. Thus, the law should limit 
the intrusiveness of government searches but should not unnecessarily hinder Saw enforcement's 
efforts to enforce the criminal laws . The language of this bill achieves this delicate balance 
between important values. 

The bill’s new provisions. Title 42, United States Code, sections 2Q0Qaa(a)(3) and 
2000aa(b)(5), make it clear that law enforcement agents may still search for or seize contraband, 
instrumentalities, and evidence not protected by the PPA, even if work product or d ocumentary 
material may Incidentally be examined or seized during a search. It is Important to note, 
however, that where ait innocent third party possesses the items sought, and if the items sought 
are commingled with work product or documentary materials, existing regulations already 
require investigators to avoid using a search warrant or subpoena where less intrusive means are 
appropriate, gee, &g„ 28 C.F.R. 50, 10 (requiring Justice Department officials to use all other 
mean s available to obtain informati on before issuing subpoena to member of the news m edia); 

28 C.F.R. §59.4(a) and 28 C.F.R, §59,4(c)(l)(n) (in determining whether to use a warrant or 
subpoena to obtain documentary materials, an attorney for the government should consider 
whether there is a dose relationship of friendship, loyalty, o r sympathy between the possessor of 
the materials and a suspect). Thus, even though the PPA would not restrict such incidental 
seizures, the Committee believes that government agents will need to consider what method is 
proper for obtaining the evidence based upon the facts of the case at hand. 

Although these amendments to the PPA address the problem of incidental searches or 
seizures, these changes do not in any way alter the statute's effect in cases like Zurcber . The law' 
enforcement officials who searched The Stanford Daily — which was not involved in any 
criminal activity — sought the very documentary materials that the PPA now protects. These 
materials, therefore, were not “incidental” to the search, and they therefore would not meet the 
exception found in the new amendments. Thus, even under the new law, when law enforcement 
agents encounter a situation like that in the Zurcher case, they will still have to use a subpoena as 
the original PPA directed. 

But in other cases, where the search is “otherwise lawful” (i.e. the object of the search is 
something other than “work product” or “documentary" materials), these amendments to the 
PPA will ensure that investigators can carry out their duties, even when PPA-protecied materials 
may be commingled with seizable ones. The amendments’ use of the term "incidental" clearly 
prohibits situations in which protected materials are the object of the search. The term 
"incidental," which appears in other statutes (see, 18 U.S.C. §2510(17)), means something 
which is "occurring or likely to occur at the same time or as a consequence." 6 Accordingly, in' 
order to be "incidental" within the intent of this provision, any search or seizure of protected 
materials would have to be a concomitant consequence of a search for materials not protected by 

6 The American Heritage Dictionary, Second College Edition ( 1 9S9) 
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1 the PPA. 7 

3 Additionally, of course, the link between the incidental items and the lawful object of the 

search or seizure must be reasonable on the facts of the case. This requir ement that such a 
5 search be reasonable is directly analogous to the Fourth Amendment requirement of 

reasonableness both in the scope of a search warrant and in its execution. See O'Connor v. 

7 Ortega, 480 U.S. 709, 726 (1987); United States v. Henson. 848 F,2d 1374 (6th Or. 1988); 

United States v. Tamura. 694 F.2d 591 (9th Cm 1982). Cases that have nothing to do with the 
9 PPA have caused courts to wrestle with whether, under all the facts and circumstances, seizing 
certain incidentai materials was sufficiently reasonable to meet the Fourth Amendment standard. 
11 Thus, 'the'ameridmenis do not, by any means, invite law enforcement to use "an otherwise 
lawful" search as a pretext for an unreasonable rummaging of other do cuments — whether 
13 protected by the PPA or not. On the contrary, this new exception to the PPA will allow courts to 
apply existing and well-established Fourth Amendment jurisprudence in analyzing the analogous 
15 question of whether arty incidental search or seizure of PPA-protected materials has been 
reasonable under the circumstances. 

17 


7 This provision docs not, of course, require that die incidental seizure of protected materials be 
inadvertent: law enforcement oSlcers may knowingly seize protected materials where such seizure is incidental so a 
lavvtui search. 
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Executive Summary 


Amendments Creating a “Clean Hands’’ Exception to Provisions Statutorily Mandating the 
Suppression of Illegally Intercepted Communications. 


The accompanying amendments would create a “dean hands” exception to the statutory 
suppression mandates of IS U.S.C. §2515 governing the use and introduction of illegally 
intercepted wire or oral communications. The proposal would allow for the use in a criminal 
investigation and the introduction into evidence in criminal matters of communications 
otherwise illegally intercepted by persons other than law enforcement, ONLY if law enforcement 
was neither directly or indirectly involved in its acquisition. Not unlike the rationale supporting 
the “good faith” exception to the Fourth Amendment’s exclusionary remedies, implicit in the 
proposed amendment is the determination that the truth-finding functions of the criminal process 
are paramount when there is little or no law enforcement deterrence effect achievable. In 
contrast to existing law which prohibits ail use, the proposed amendment would allow the 
introduction of such evidence both when it is inculpatory or exculpatory in nature. 
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“Clean Hands” Exception to Statutory exclusionary Rule 

(Exclusive of Other Substantive Amendments) 

Section 25 1 5. Prohibition of use as evidence of intercepted wire or oral communications 

(a) Exbept insubsectlpa Whea evee any or oral communication 

has been intercept^, no part of the contents of such communication and no evidence derived 
therefrom may be received in evidence in any trial, bearing, or other proceeding in or before any 
court, grand jury, department, officer, agency, regulatory body, legislative committee, or other 
authority of the United States, a State, or a political subdivision thereof if the disclosure of that 
information would be in violation of this chapter. 


13 

15 

17 

19 

21 
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mammas 








23 

Section 2 517. Authorization for disclo sure and use of intercepted wire, oral, or electronic 
25 communications 


27 { 1 ) Any investigative or law enforcement officer who, by any means authorized by this chapter 

has obtained knowledge of the contents of 

2 9 any wire, oral, or electronic communication, or evidence derived therefrom, may disclose such 
contents to another investigative or law enforcement officer to the extent that such disclosure is 

31 appropriate to the proper performance of the official duties of the officer making or receiving the 

disclosure. 

33 

(2) Any investigative or law enforcement officer who, by any means authorized by this chapter 
35 has obtained knowledge of the contents of 

any wire, oral, or electronic communication or evidence derived therefrom may use such 
37 contents to the extent such use is appropriate to the proper performance of his official duties, 

39 (3) Any person who has received, by any means authorized by this chapter, any information 

concerning a wire, oral, or electronic communication, or evidence derived therefrom intercepted 
41 in accordance with the provisions of this chapter may disclose the contents of that 

communication or such derivative evidence while giving testimony under oath or affirmation in 
4 3 any proceeding held under the authority of the United States or of any State or political 
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(4) No otherwise privileged wire, oral, or electronic communication intercepted in accordance 
with, or in violation of, the provisions of this chapter shall lose its privileged character, 

(5) When an investigative or law enforcement officer, while engaged in intercepting wire, oral, 
or electronic communications in the manner authorized herein, intercepts wire, oral, or electronic 
communications relating to offenses other than those specified in the order of authorization or 
approval, the contents thereof and evidence derived therefrom, may he disclosed or used as 
provided in subsections (I) and (2) of this section. Such contents and any evidence derived 
therefrom may be used under subsection (3) of this section when authorized or approved by a 
judge of competent jurisdiction where such judge finds on subsequent application that the 
contents were otherwise intercepted in accordance with the provisions of this chapter. Such 
application shall be made as soon as practicable. 


Section 25 1 8. Procedure for interception of wire, oral, or electronic communications 

(1) Each application for an order authorizing or approving the interception of a wire, oral, or 
electronic communication under this chapter shall be made in writing upon oath or affirmation to 
a judge of competent jurisdiction and shall st ate the applicant's authority to make such 
application. Each application shall include the following information: 

(a) the identity of the investigative or law enforcement officer making the application, 
and the officer authorizing the application; 

(b) a mil and complete statement of the facts and circumst ances relied upon by the 
applicant, to justify his belief that an order should be issued, including (i) details as to the 
particular offense that has been, is being, or is about to he committed, (ii) except as 
provided in subsection (1 1), a particular description of the nature and location of the 
facilities from which or the place where the communication is to be intercepted, (hi) a 
particular description of theftype of communications sought to be intercepted, (iv) the 
identity of the person, if known, committing the offense and whose communications are 
to be intercepted; 

(c) a full and complete statement as to whether or not other investigative procedures have 
been tried and failed or why they reasonably appear to be unlikely to succeed if tried or 
to be too dangerous; 

(d) a statement of the period of time for which the interception is required to be 
maintained. If the nature of the investigation is such that the authorization for 
interception should not automatically terminate when the described type of 
communication has been first obtained, a particular description of facts establishing 

Clean Hands Exception 
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probable cause to believe that additional communications of the same type will occur 
thereafter; 

(e) a foil and complete statement of the facts concerning all previous applications known 
to the individual authorizing and making the application, made to any judge for 
authorization to intercept, or for approval of interceptions of, wire, oral, or electronic 
communications involving any of the same persons, facilities or places specified in the 
application, and the action taken by the judge on each such application; and 

(f) where the.application is for the extension of an order, a statement setting forth the 
results thus far obtained from the interception, or a reasonable explanation of the failure 
to obtain such results. 


(2) The judge may require the applicant to furnish additional testimony or documentary evidence 
in su pport of the application, 

(3) Upon such application the judge may enter an ex parte order, as requested or as modified, 
authorizing or approving interception of wire, oral, or electronic communications within the 
territorial jurisdiction of the court in which the judge is sitting (and outside that juri sdiction but 
within the United St ates in the case of a mobile int erception device authorized by a Federal court 
within such jurisdiction), if the judge determines on the basis of the facts submitted by the 
applicant that— 


(a) there is probable cause for belief that an individual is committing, has committed, or 
is about to commit a particular offense enumerated in section 2516 of this chapter; 

i 

(b) there is probable cause for belief that particular communications concerning that 
offense will be obtained through such interception; 

(c) normal Investigative procedures have been tried and have failed or reasonably appear 
to be unlikely to succeed if tried or to be too dangerous; 

(d) except as provided in subsection (1 1), there is probable cause for belief that the 
facilities from which, or the place where, the wire, oral, or electronic communications are 
to be intercepted are being used, or are about to be used, in connection with the 
commission of such offense, or are leased to, listed in the name of, or commonly used by 
such person, 

(4) Each order authorizing or approving the interception of any wire, oral, or electronic 
communication under this chapter shall specify— 


(a) the identity of the person, if known, whose communications are to be intercepted; 
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(b) the nature and location of the communications facilities as to which, or the place 
where, authority to intercept is granted, 

(c) a particular description of the type of communication sought to be intercepted, and a 
statement of the particular offense to which it relates; 

(d) the identity of the agency authorized to intercept the communications, and of the 
person authorizing the application; and 

(e) the period, of time during which such interception is authorized, including a statement 
as to whether or not the interception shall automatically terminate when the described 
commumcation has been first obtained 

An order authorizing the interception of a wire, oral, or electronic communication under this 
chapter shall, upon request of the applicant, direct that a provider of wire or electronic 

“ tr f ^ lantfior^ custodian or other person shah furnish the applicant forthwith 
au miormation, facilities, and technical assistance necessary' to accomplish the interception 
unobtrusively and with a minimum of interference with the services that such service provider 
n or , custodian or person is according the person whose communications are to be 
intercepted. Any provider of wire or electronic communication service, landlord, custodian or 
other person tailing such facilities or technical assistance shall be compensated therefor bv 
B e app icant ^ 0r reasona ^^ e ex P enses tocurred in providing such facilities or assistance, 
ursuant to section 2522 of this chapter, an order may also be issued to enforce the assistance 
capability and capacity requirements under the Communications Assistance for Law 
Enforcement Act. 

(5) No order entered under this section may authorize or approve the interception of any wire 
oral, or electronic communication for any period longer than is necessary- to achieve the 
objective of the authorization, nor in any event longer than thirty days. Such thirty-day perio d 
begins on the earlier of the day on which the investigative or law enforcement officer first begins 

ort«v “f" "" °* r ° r . “ aays aft ' r ,he or<ier is Extensions of an 

may be granted, but only upon application for an extension made in accordance with 

su sectional) of this section and the court making the findings required by subsection (3) of this 

TIT Pen ° d of e f ™ shaiI be » ^nger the authorizing judge deems necessary 

p achjev J the Purposes for which it was granted and in no event for longer than thirty days 
Every order and extension thereof shall contain a provision that the authorization to intercom 
, be executed as soon as practicable, shall be conducted in such a way as to minimize the 
interception of communications not otherwise subject to interception under this chapter and 
must terminate upon attainment of the authorized objective, or in any event in thirty davs in t he 
event the intercepted communication is in a code or foreign language, and an expert in that 
oreip language or code is not reasonably available during the interception period, minimization 
may be accomplished as soon as practicable after such interception. An interception under this 
chapter may be conducted m whole or in part by Government personnel, or bv an individual 
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operating under a contract with the Government, acting under the supervision of an investigative 
or law enforcement officer authorized to conduct the interception. 





require repons to be made t o the judge who issued the order showing what progress has been 
made toward achievement of the authorized objective and the need for cont inued interception. 
Such reports shall be made at such intervals as the judge may require. 

(/) Notwithstanding any other provision of this chapter, any investigative or law enforcement 
officer, specially designated by the Attorney General, the Deputy Attorney General, the 
Associate Attorney General or by the principal prosecuting attorney of anv State or subdivision 
thereof acting pursuant to a statute of that State, who reasonably d etermines that- 


(a) an emergency situation exists that involves— 

(i) immediate danger of death or serious physical injury to any person, 

(ii) conspiratorial activities threatening the national security interest, or 
(id) conspiratorial activities characteristic of organized crime 

that requires a wire, oral, or electronic communication to be intercepted before an order 
authorizing such interception can, with due diligence, be obtained, and 

(b) there are grounds upon which an order could be entered under this chapter to 
authorize such interception. 


may intercept such wire, oral, or electronic communication if an application for an order 
approving the interception is made in accordance with this section within forty-eight hours after 
intercept™ , has ocean* or begins .0 occur, lo rhe ,bs« e of anord^ suSSta 
shall immediately terminate when the communication sought is obtained or when the anplicaticn 

i Whi t heW iS b lh ' Sucb w " rado '> for «*ov,H s denied. 

rA ' h case where the Perception is terminated without an order having been issued the 

contents of any wire, oral, or electronic communication intercepted shall be treated as having’ 
seen ob tained in violation of this chapter, and an inventory shall be served as provided for in' 

subsection |||(d) of this section on the person named in the application, 

(a) The contents of any wire, oral, or electronic communication intercepted by anv mean s 
authorized by this chapter shall, if possible, be recorded on tape or wire or other " 
comparable device. The recording of the contents of any wire, oral, or electronic 
communication under this subsection shall be done in such way as will protect the 
recording from editing or other alterations, immediately upon the expiration of the 
period of the order, or extensions thereof, such recordings shall be made available to the 
judge issuing such order and sealed under his directions. Custody of the recordings shall 
be wherever the judge orders. They shall not be destroyed except upon an order of the 
issuing or denying judge and in any event shall be kept for ten years. Duplicate 
recordings may be made for use or disclosure pursuant to the provisions of subsections 


( 8 ) 
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3. (1) and (2) of section 2517 of this chapter for investigations. The presence of the seal 

provided for by this subsection, or a satisfactory explanation tor the absence thereof, 

3 shall be a prerequisite for the use or disclosure of the contents of any wire, oral, or 

electronic communication or evidence derived therefrom under subsection (3) of section 
5 2517. 


7 

9 


11 


13 


IS 


17 


19 

21 

23 

25 

27 

29 


31 


33 

35 

37 

39 

41 


(b) Applications made and orders granted under this chapter shall be sealed by the judge. 
Custody of the applications and orders shall he wherever the judge directs. Such 
applications and orders shall be disclosed only upon a showing of good cause before a 

. judge of competent jurisdiction and shall not be destroyed except on order of the issuing 
or denying judge, and in any event shall be kept for ten years. 

(c) Any violation of the provisions of this subsection may be punished as contempt of the 
issuing or denying judge. 

(d) Within a reasonable time but not later than ninety days after the filing of an 
application for an order of approval under section 2538(7)(b) which is denied or the 
temunation of the period of an order or extensions thereof the issuing or denying judge 
shall cause to be served, on the persons named in the order or the application, and such 
other parties to intercepted communications as the judge may determine tn Ms discretion 
that is in the interest of justice, an inventory which shall Include notice of~~ 

(1) the fact of the entry of the order or the application; 

(2j the date of the entry and the period of authorized, approved or disapproved 
interception, or the deni al of the application; and 

(3) the fact that during the period wire, oral, or electronic communications were 
or were not intercepted. 

The judge, upon the filing of a motion, may in his discretion make available to such person or his 
counsel for inspection such portions of the intercepted communications, applications and orders' 
as the judge determines to be in the interest of justice. On an ex parte showing of good cause to 

a judge of competent jurisdiction the serving of the inventory required by this subsection mav be 
postponed. 

(9) The contents of any wire, oral, or electronic communication intercepted pursuant to this 
chapter or evidence derived therefrom shall not be received in evidence or otherwise disclosed in 
any trial, hearing, or other proceeding in a Federal or State court unless each party, not less than 
ten days before the trial, hearing, or proceeding, has been furnished with a copy of the court 
order, and accompanying application, under which the interception was authorized or approved. 
This ten-day period may be waived by the judge ifhe finds that it was not possible to furnish the 
party with the above information ten days before the trial, hearing, or proceeding and that the 
party will not be prejudiced by the delay In receiving such information. 


(10) (a) Any aggrieved person in any trial, hearing, or proceeding in or before any court. 
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department, officer, agency, regulatory body, or other authority' of the United States, a 
State, or a political subdivision thereof, may move to suppress the contents of any wire or 

oral communication intercepted pursuant to this chapter, or evidence derived therefrom 
on the grounds that- " ? 

(i) the communication was unlawfully intercepted; 

(ii) the order of authorization or approval under which it was intercepted is 
insufficient on its face; or 


(iii) the interception was not made in conformity with the order of authorization 
or approvafc§ 

^ ^ £d^oJn sliadi^e miaide sin^^Sj^aring^'^r proceSn|^i23£e 
was no opportunity to make such motion or the person was not aware of the grounds of 
the motion. If the motion is graated,|the contents of the intercepted wire or oral 
communication, or evidence derived therefrom, shall be treated as having been obtained 
m violation of this chapter. The judge, upon the filing of such motion by the aggrieved 
person, may m his discretion make available to the aggrieved person or Ms counsel for 
inspection such portions of the intercepted communication or evidence derived therefrom 

as the judge determines to be in the interests of justice. 


(b) In addition to any other right to appeal, the United States shall have the right to 
appeal from an order granting a motion to suppress made under paragraph {af of this 
subsection, or the denial of an application for an order of approval, if the United States 
attorney shall certify to the judge or other official granting such motion or denying such 
application that the appeal is not taken for purposes of delay. Such appeal shall be taken 
within thirty days after the date the order was entered and shall be diligently prosecuted. 


(g The remedies and sanctions described in this chapter with respect to the interception 
or electronic communication are the only judicial remedies and sanctions for non- 
constitutional violations of this chapter involving such communications. 
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“Clean Hands” Exception Proposed Legislative History 

Inapplicability of 18 US,C. §2515 statutory exclusion and non-use of certain “clean 
hands” good faith disclosures 

This proposed change makes a carefully limited amendment of 18 U S C §?51 5 the 
statutory exclusionary- rule for violations of Title Hi of the Omnibus Crime Controfand Safe 
Streets Act of 1968, so as clearly to exempt two situations: (1) those in which private individuals 
illegally intercept or record a communication, but the recording later comes into the possession 
or a party m a comma! trial, who then wishes of introduce it; and (2) those in which an 

' v ' 10 1 ateS , ehapt 5 1 19 {e g \> by ^ging in an illegal wiretap) and the government 
tnereatter seeks of use the communication to prosecute that violator. 

At present, appellate decisions are in apparent conflict over whether section 2515 

f^ZV be T ofco “ c f ons > * e category described above. Under one possible 
0 f^f in J. 0n ^. ^ Ctl0n ,7' lfa P n J 3te individual consensu ally records a conversation in aid 
of an illegal activity, or illegally records a conversation between other parties without their 
consent, the contents of such recordings are not admissible in a criminal trial or hearing even if 
government had no role m having the evidence recorded and only acquired it, through lawful 

not * iv er A ? SIt ?f 0n 0CCUrS because > under !S US C - § 25 1 K2){d). a consenting 

§ Under ^ l0r 0f ,aw> may record on3y tf the wording is for a non-criminal or ~ 

she 0^?? ffi ■ TT ° f a bdbe $eCretly reCOfds 1316 transact5ofi in which he or 

h a f f l *?• f 6 S ° Vemment latcr obtaks t5ie recordi ng ^d seeks of use 

fc amst the official of prove the bnbe, section 2515 arguably precludes such use. One 

appellate court has so held. United States v. Vest 813 F.2d 477 (1st Cir. 1987) 

By contrast, another appellate court has held that section 2515 does not bar the 
fr ° m Wordings made by an gambling business (of bets placed by 

™ th bett0rs over ** ^nnts of their bets. Unitedly 
Lndgrh^i, 8b F.2d 105 (6th Cir.), pert, denied, 484 U.S. 821, 846 (1987). While the court in 
Vest acknowledged that no deterrent purpose would be served by suppression because the 

T l ? J WO “ , d “^*'° n ^ p " vai5 ' viola,ion - The corn in Underhill 0 „ 

breadth f ff le » 5lat « UstOT y Wicatag that Congress, despite the facial 

of section -515, did not intend to permit lawbreakers to immunize themselves from 
prosecution by the very criminal purposes that made the recordings illegal 

The same disagreement among circuit courts exists regarding the admissibility of 

pmietln nn de ** ^ a f t0fS ^ rc8 P t ^ communications without the consent of any of the 
P es. In one case, a court barred the use before a grand jury of such illegally intercepted 

communications. See In re Grand Jurv. m F3dl066fMr; r l 00 ?! tWnm-tr i t 

c«*n*t!v imtatu , 7- T~~- 7 1 vir - ay contrast, where a wife 

thelmh r ! recording device to intercept her husband’s conversations with other persons, 
the Sixth Circuit concluded that section 25 1 5 did not bar the use of the contents of those 
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communications in a prosecution of the husband, given the government's tack of involvement tn 
the original interception. See United States v. Murdock 63 F.3d 1391 ( 6 & Cir. 1995). 

WTiether or not Vest and In re Grand Jury were correctly decided under the existing 
statutory provision, an exemption should be created under section 2515 for that narrow class of 
cases in which the government lawfully obtains illegal recordings made by private parties and 
seeks to use them as evidence in a criminal investigation, proceeding, hearing or trial, or before a 
grand jury. The truth-seeking function of a criminal proceeding is of paramount importance. In 
the absence of any det errent purpose to be saved by exclusion, this truth-seeking function 
should prevail over tire concern that disclosure in the criminal proceeding would somehow 
exacerbate the original illegal recording. 

Conversely, if evidence contained in an illegally intercepted recording tends to exculpate 
a defendant, that defendant should be entitled to introduce the evidence so long as he did not 
participate in the interception in any way. The instant amendment thus reflects the belief that a 
pnvate violation of the statute should not trigger the severe result of exclusion of otherwise 
probative evidence k a criminal case (just as the Fourth Amendment, of course, does not 'apply 
to non-governmental searches and seizures*). Accordingly, this section would amend section * 
*.-15 to expressly exempt such disclosures from its purview. 

In addition, the amendment would also darify that illegal intercepts made be used for the 
limited purpose of prosecuting the individual who conducted the illegal interception. In one 
recent case, Un ited States v. Onc e, ^7 F, Sapp. 2d 428 (D. S.C. 1998), an employee of a county 
snentt s department illegally intercepted conversations between two prisoners and their 
attorneys. When the United States sought to use the recording of prosecute that violation, the 
district court ruled the evidence inadmissible. The amendment would permit such use for the 
purpose of prosecutkg the violator of chapter 1 19. Conforming amendments are also made of 
subsections (3 ) and (2) of section 2517 and subsection 2518(10){a) . 


B 

The history of section 25 1 5’s original enactment makes clear that Congress intended that itanbodv 
ex^g Fourth Anwndment fmdams. SeeS. Rep. No. 1997, Cong. 2d Sess.. renrinwd m 1968 U S, C C AN. 
v3 (no intension "of press vnt scope of the suppression role bey ond present scorch and seizure \m '\ 
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MATTER NOT CONTAINED 
IN BILLS CURRENTLY UNDER CONSIDERATION 


Emergency Fen Register/Trap and Trace authority at field level. 
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Executive Summary 

Amendment Creating Emergency Pen Register/Trap & Trace Authority for US Attorneys 
and Top Law Enforcement, ' * 

Under current law, 1 S U.S.C. § 3 125(a), an emergency pen register or trap & trace mav 
e aut onzed only by certain high level DOI officials or “any investigative or law' enforcement 
o cer specially designated by the Attorney General” or, In cases involving the States the 
equivalent of the County District Attorney. Emergency pen register or trap & trace orders are 
authorized under section 3125(a) only when there exists an immediate danger of d eath or serious 
odily injury to any person, or where there are conspiratorial activities characteristic of 
organized crime. And this bill will add two other emergency circumstances to bring the pen 
register statute in relative parallel with the wiretap emergency provisions and to acknowledge 

mat attacks on certain government or public computer infrastructure could seriously endanger 
the public health or safety. 3 * 

Even in emergency situation, a court order ratifying the use of the pen regi ster or trap & 
trace must be sought and obtained within 48 hours. Since the current statute authorizes the 

m r ^ Ster 2t *" SMe leVel by ** Coiint >’ District Attorney, it has 
been argued that the current restncttons on emergency deployment by Federal authorities are bv 

comparison, incongruous, unnecessarily restrictive, cumbersome and time consuming. Based ' 
upon law enforcement’s experience, the problem is especially acute in dynamic computer 
investigations where time is frequently of the essence. The proposed amendment would in 
addition to the class of DOJ officials currently authorized to issue emergency pen registers or 
implement trap & trace, statutorily authorized the issuance of emergency implementation upon 
the request of either a "Uatet States Attorney or te^pal sup^s^e iL enfor^ 


officer Si' Umted bt3teS Attoraey or the PnnctP** supervising law enforcement 

vests “ P ea L n f ster ortra P and trace 5f » an emergency situation 

JJ a«ffionfy with the official who is m the best position to assess the need and propriety of use 

en e passing of mere minutes may mean the loss of valuable information, for example in an 

roS S f? Uter attack ' At the S3me tkne ’ t& es P fess designation will continue to assure the 
nsistent administration of law enforcement policy on the use of pen registers and trap and 

trace devices by retaining centralized responsibility for approving emergency use in a limited 
number ot identifiable and politically accountable officials . 9 


S. Rep. Mo. 1097 90th Cong. 2dSes$. (19 6$), reprint J in 196SU.S.C.CAN "MP ’185 ( amroval 
level tor wiretap applications). • J - P?TO * > ‘ 

i nip ^ Trace Ajricntirnent 
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Expediting Emergency Pen Register and Trap & Trace Implementation 
(Exclusive of any other Amendments) 

Section 3 1 25. Emergency pen register and trap and trace device installation 

(^Notwithsmding any other provision of this chapter, -any investigative or law onfo rccmuu 
otficcr, 3pcci% de3igMted by the Attorney General, the Deputy Attorney General, the 


9 •■■Si 8KS» SilS 

prc f cutins att ° mey of any State or subdivision thereof amine pmS to ^statute of 
tnat state, who reasonably determines that— 
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5 Title IH Wiretap Exception for the Interception of Unauthorized Computer Trespassers 
Only upon the Written Request of the Owner/operator of the Computer Syst em. 
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(Irrespective of other Amendments) 




[18U.S.C. §2511] 








'fansmiuvs to or from jj co*puti trcsp||p ** 


[18 US.C. §2510] 

2S lfi5 rtS^^& ed t0 ‘ togh> ° r fr ° m 3 pf0teaed computer becau^rach^Sn is' 
accessing the^stected computer without authorization, ^ * " 


mm? 
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Bowsed Legisutiw b,„ 

Tn E Bctor '' n* Computer tr™*. 

^ SPASSm ^^ xctnim 
private electrT end,nerit ^° WS ’ bW d ° eS not squire owners and 

; te eie ^tr°njc or wire communication service . ^^^orsof^erpu^ or 

^mmunications/tran,m- • 68 £o mho ™ law enW* 

transmissions of a party DerMn - emem to mterceot th^ 

""*» *» *« JT* PTO ” or “■*■* rto the owner or one , 

network Tfi >s ao unauthorized ne pereior of fhrf 

* entendmeot is premised nun e " 00 ®n>PWer sv !tem 

““Othorieed^ie h t md Ktao ^S« legal M „ , * *”“* 

S «-«V <W * ■*“*■ ° f P™* » there to^onL * ^ 

3«on of the exception. pnor ^ writt en so as to 


Computer Trespasser r Pr 


5 / 24/02 Release- Par ^ 36 



( 05 / 26 / 1998 ) 




? L IC -} 


FEDERAL BUREAU OF INVESTIGATION 



Precedence: DEADLINE 07/21/2000 

To: Director's Office 

Laboratory Division 
Office of General Counsel 


Date: 07/17/2000 

Attn: Deputy Director's Office 

Mr. Pickard 
Dr . Kerr 
Mr. Parkinson 


From: Director's Office 

Office of Public and Congressional Affairs 
Congressional Affairs Office 
Contact: SSA! 


Approved By: Pickard Thomas J 

Kerr Donald M 
Parkinson Larry R 


c-l 


Collin 


Drafted By: 

Case ID # : 62C-HQ- 1077728 



Title: ACTION MEMORANDUM : 

HOUSE JUDICIARY COMMITTEE; 

CONSTITUTION SUBCOMMITTEE; 

HEARING ON "FOURTH AMENDMENT ISSUES RAISED BY THE FBI'S 
1 CARNIVORE ' PROGRAM " 

07/24/2000 

Synopsis: The Constitution Subcommittee of the will conduct a 

hearing on Monday, 07/24/2000, at 1:00 PM, in Room 2141 of the 
Rayburn House Office Building. The purpose of the hearing is to 
examine "Fourth Amendment issues raised by the FBI's 'Carnivore' 
program." Consequently, the Subcommittee has requested that 
Laboratory Division Director Dr. Donald M. Kerr and General 
Counsel Larry R. Parkinson appear on behalf of the FBI. 

Details: The Constitution Subcommittee will conduct a hearing to 

examine Fourth Amendment issues raised by "Carnivore." The 
Subcommittee has preliminarily advised that the hearing will be 
composed of two panels. The first panel will have witnesses from 
the U.S. Department of Justice (DOJ) , to include the FBI. The 
second panel will be composed of individuals from private 
industry and Internet privacy groups. It is anticipated that 
Deputy Assistant Attorney General Kevin DiGregory , as well as 
David Green from CCIPS, will represent the Department. The 
specific private sector witnesses have not yet been determined. 
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To: Director’s Office From: Director's 0££&^ Office 

of Public and Congressional Affairs 
Re: 62C-HQ- 1077728, 07/17/2000 


The Subcommittee has requested that the Laboratory 
Division and the Office of the General Counsel provide a written 
statement for the. official record which the witnesses may 
summarize for the Subcommittee. The written statement must also 
be provided to the Subcommittee on a computer disk or through 
email. These items must be provided to the Subcommittee no later 
than Friday, 07/21/2000. A letter of invitation from the 
Subcommittee has not yet been received. 

LEAD (s) : 

Set Lead 1: 

PI RECTOR 1 S OFF I CE 


AT WASHINGTON, PC 

It is requested that the Deputy Director approve Dr'. 
Kerr and Mr. Parkinson's participation as witnesses at captioned 
hearing . 

APPROVE 

DISAPPROVE 

SEE ME 


Set Lead 2 : 

LABORATORY 


AT WASHINGTON- DC 


It is requested that the Laboratory Division prepare 
testimony, with assistance from th^Of^m^o^^eneral Counsel, 
for Dr. Keo^md provide it to SSA KoomHHl J>7C 
Extension vHK &y COB 07/19/2000, ^^^e^that^t may be 
transmitted to PQJ for clearance and then to the Subcommittee in 
a timely fashion. 


7 

-/ 
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To: Director's OfsUce From: Director's Of f L ■,& Office 

of Public and Congressional Affairs 
Re: 62C-HQ- 1077728, 07/17/2000 


Set Lead 3 : 


GENERAL COUNSEL 

AT WASHINGTON , DC 

It is requested that the Office of General Counsel 
assist the Laboratory Division, as needed, in the preparation of 
testimony for captioned hearing. 


Set Lead 4s 


OFFICE OF PUB L IC AND CONGRESSIONAL AFFAIRS , 
CONGRESSIONAL AFFAIRS OFFICE 


AT WASHINGTON. DC 


The Congressional Affairs Office will 
appearances of Dr. Kerr and Mr. Parkinson before 


coordinate 

the 


the 


Subcommittee; the approval of the testimony from the Deputy 
Director's Office; and the voting of the testimony by DOJ. 



♦♦ 
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; INTERCEPTION OF E-MAIL 

White House Tries to Balance 
• Rights of Computer Users* 
and Law Enforcement 

By STEPHEN LAB ATOM 
with MATT RICHTEL 

WASHINGTON, July 17 - The 
White House said ted ay that it would 
propose legislation to set legal re- 
quirements for surveillance in cy- 
berspace by law enforetmerH au- 
thorities similar in some ways to 
those for telephone wiretaps. 

Privacy advocates and civil liber- 
tres groups welcomed some aspects 
of the proposal but said they re- 
mained alarmed about a new RBI 
computer system that searches and 
intercepts private e-mail and can 
easily capture communications of 
people not suspected of crimes. 

The legislative proposal w as made 
as the administration also an- 
nounced today that it had eased ex- 
port controls o n encryption technol- 
ogy, making ii significantly easier 
lor American companies to sell soft- 
ware products to the European 
Union and eight other trading pan- 
nets that cart be used to keep com- 
puter data and communications se- 
cure. 

Both the electronic surveillance 
proposal and the export control 
changes are part of a broader policy 
outlined in a speech today by John D, 
Podesta, the White House chief of 
staff. He said the policy tries to bal- 
ance the privacy rights of computer 
M$ers against the needs of law en- 
forcement to be able to monitor digi- 
tal communications. 

Congress and federal regulators 
have done little work in the area, 
even as the world has quickly come 
to rely heavily on commtinicaiions 
through cyberspace- More than 1.4 
billion e-mail messages change 
hands every day. 



The administration's legislative 
proposal on electronic surveillance 
tries to fix the inconsistent patch- 
work of laws that apply different 
standards to telephone, cable and 
other technologies with a single 
standard for those systems and the 
Internet Prospects for the proposal 
in Congress are uncertain. 

Until now, law enforcement agen- 
cies have been able to monitor elec- 
tronic communication with only 
modest court supervision. 

The proposed legislation would re- 
quire that the same standards that 
apply to the interception of the con- 
tent of telephone calls apply to the 
interception of e-jnad messages. Spe- 
cifically, it would retire law en- 
forcement agents to demonstrate 
that they have probable cause of a 
crime to obtain a court order seeking 
the contents of a suspect's e-mail 
messages. 

The proposal would also give fed- 
eral magistrates greater authority to 
review requests by law enforcement 


authorises for so-called pen regis- 
ters — lists of the phone numbers 
called from a particular location and 
the time of the calls. The magistrates 
now ha ve no authority to question the 
request for such lists, which are fre- 
quently used by die authorities, 
v in the context of the Internet, ex- 
isting laws are ambiguous about 
what standards apply tor different 
kinds of surveillance. Many limita- 
tions imposed on law enforcement in 
the context of telephone wiretaps — 
like the requirement that such taps 
be approved at the highest level of 
the Justice Department — do not 
appear to apply to e-mail surveil- 
lance 

Moreover, the Cable Act of ISS4 
sets a far harder burden for govern- 
ment agents to satisfy when trying to 
monitor computers using cable mo- 
dems than when monitoring tele- 
phones That has proved trouble- 
some for law enforcement author!* 
ties as more Americans begin to use 
high-speed Internet service through 
cable networks. The Cable Act also 
requires that the target of the sur- 
veillance be given notice and m op- 


Concern that the 
proposals allow 
federal agents too 
much leeway. 



ponunity to challenge the request. 


*Tt's time to update md harmo- 
nize our existing law's to give all 
forms of technology the same legis- 
lative protections as our telephone 
conversations/' Mr, Fodesta said in 
a speech at the National Press Club. 
"Our proposed legislation would bar* 
momie the legal standards that ap- 
ply to law enforcement's access to e- 
mails, telephone calls and cable 
serviCfis." 

Wite House officials said today 
that they hoped the proposal would 
break a logjam in Congress where a 
variety of different measures have 
been introduced dealing with elec- 
tronic surveillance. The administra- 
tion's proposal adopts seme ele- 
ments of both Democratic and Re- 
publican bills. 

But Congressional aides said there 
was too little time left in the legisla- 
tive session and that the matter 
would in all likelihood remain unre- 
solved until after the next term be- 
gins, in 2003 . 

Administration officials said the 
proposal would apply io communica- 
tions that either begin or end in the 
United Slates. It would not apply toe- 
mail messages transmitted entirely 

outside the country. 

Privacy and civil liberties groups 
criticized the administration's pro- 
posal because it would continue to 
v perm it the government to use a new 
surveillance system that the groups 
say may be used far more broadly 
than older technologies, enabling fed- 
eral agents to monitor an unlimited 
amount of innocent communications* 
including those of people who are not 
targets ef criminal investigations. 

The system, used by the Federal 
Bureau of Investigation, is called 
Carnivore, so named, agents say, be- 
cause h is able to quickly get the 
“meat" in huge quantities of e-maii 
messages, so-called instant messag- 
ing and other communications be* 
tween computers. 

Carnivore is housed in a small 
black box and consists of hardware 
and software that trolls for informs* 
tiem after being connected to the net- 
work of an Internet service provider. 
Once Installed, it has the ability to 
monitor ail of the e-mail on a net- 
work, from the list of what mail is 
sent to the actual contain of the com- 
munications. 
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Marcos C. Thomas, secu^Lhief of 
the Cyber Technology Section of the 
F.B.L, said the technology was devel- . 
oped U months ago by F.B.l engi- 
neers and has been used fewer than 
25 times. Mr, Thomas said that Car- 
nivore had potentially broad capahil- 
hies and that he understood the con- 
cerns of privacy groups. 

“It can do a ton of things/' he said, 
"‘That's why it’s illegal to do so with- 
out a clear order f rom the court/* 

He said that mm Internet service 
providers had cooperated with re- 
quests to use Carnivore. 

Privacy groups and some Internet 
sendee providers have been deeply 
critical of the use of Carnivore be- 
cause, once Installed on a network, it 
permits the government to take 
whatever information it wants. 
Moreover, the government has not 
said what it does with the extraneous 
material iV gathers that is not rele- 
vant to the particular surveillance, “ 
The issue does not often arise to- 
day with the monitoring of telephone 
conversations because when a law j 
enforcement authority wants to see a 
tost of telephone calls made by a 
suspect, the agent gets an order from 
a magistrate, presents the order to a 
telephone company, and the compa- 
ny then turns over the list. 

In at least one instance, an Inter- j 
net company did not cooperate so 
readily with the government. In De- 
cember, federal marshals ap* j 
preached the company with a court j 
order permitting them to deploy a j 
device to register time, date and l 
source information involving e-mail 
messages sent to and from a speci- 
fied account. 


Trying to establish a 
single standard for 
different 
technologies. 


Concerned the device would 
record broader information, the 
company countered with a compro- 
mise: ft would provide the govern- 
ment with the requested information 
about e-mail senders and recipients, 
according to Robert Corn -Revere, a 
lawyer for the company, in recent 
Congressional testimony. The com- 
pany was later identified as Earth- 
Link, a service provider with 15 mil- , 
lion subscribers. 

Mr. Corn-Re vere said the govern- 
ment initially accepted the compro- 
mise but later became dissatisfied 
and wished to use its own device, 
EanhLmk objected but was over- 
ruled by a a federal court, which 
ordered the de vice deployed. 

Other Internet companies have 
also been critical of Carnivore. 



William Lv Schrader, chairm/ % 
and chief executive of PSINet* a i £^/ 
jor commercial Internet service pro- 
vider, said that the system gave the 
F,BX the ability to monitor e-mail 
messages of every person on a given 
network. He said he would refuse to 
permit the government to use the 
technology at PSINet unless 2 gems 
could prove that it could only sift out 
the traffic from a given individual 
that is the target of a court order. 

'■| object to American ci tiaern and 
any citizens of the world always be- 
ing subject to someone monitoring 
their e-mail/* said Mr. Schrader, 
whose company serves about 100,000 
businesses and more than 10 million 
users. *1 believe irstmconstrtutlonal 
and HI wait for the Supreme Court to 
force me to do it/* 

Civil liberties groups, meanwhile, 
said that today's policy announce- 


mem was an inadequate response to 
the growing controversy over the 
deployment of Carnivore. 

“Today’s speech was camouflage 
to cover the mess that i$ Carnivore/' 
said Barry Steinhardi, an associate 
director of the American Civil Liber- 
ties Union. “In light of the public and 
Congressional criticism of Carni- 
vore, we had hoped and expected far 
more from an administration that 
likes to tout its sensitivity to privacy 
rights. Rather than glossing over 
Carnivore, Fodesta should have an- 
nounced that the administration w as 
suspending its use." 

Facing growing concerns about 
Carnivore, Attorney General Janet 
Reno said on Thursday that she 
would review' whether the system 
was being used in a manner consis- 
tent with privacy rights in the Consti- 
tution and in federal law*, a subcom- 
mittee of the House is set to hold a 
hearing next week on the system. 

While the civil liberties and pri- 
vacy groups applauded giving judges 
greater discretion to review' certain 
kinds of requests for surveillance, 
they were critical of other aspects of 
the proposal. 

Marc Roienberg, director of the 
Electronic Privacy Information Cen- 
ter, a research organization that 
studies privacy issues and technol- 
ogy, criticized the administration for 
lowering the standards for surveil- 
lance of cable modems rather than 
raising the standards for telephone 
surveillance. 

“The Cable Act provides for one of 
the best privacy protections in the 
United States/* Mr, Rotenberg said, 
“The question is whether to harmo- 
nize up or harmonize down. Our view 
is this harmonizes down/* 

But administration officials said 
the Cable Act never contemplated 
that there would be broad use of 
cable modems for e-mail traffic and 
that the standards used for obtaining 
warrants for telephone surveillance 
should also apply to digital commu- 
nications through cable networks. 
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The Clinton administration yes- * 
torday called for updating wiretap- 
ping Jaws to extend the powers of 
law enforcement to the online world 
while providing new legal protec- 
tions for electronic eommtirueaf ion. 
Administration officials also an- 
nounced, asexpecteiaplan tolooS' 
en con trols on the export of enejyp- . 
tioit software — the programs that 
help Internet users scramble mes- 
sages and data to protea them from 
PWjgeyes. 

On the wiretapping issue. White 
House chief of staff John D. Pode- 
sta, in 3 speech at the National Press 
Club, described the coming legisla- 
tive package as seeking to eliminate 
confusion about the level of legal 
protection for various forms of com- 
munication. 

Telephone conversations get fair* 
ly strong protection from federal 
wiretaps under the 1966 Crime Pa- 
trol and Safe Streets Act, which re- 
quired s court order and high-level 
Justice Department approval Wire- 
tape rules for e'tftail sent by dial-up 
modem are covered by the Electron- 
ic Communications Privacy Act of 
I9S6, That law might not cover e- 
rmil sent by high-speed cable mo- 
dem, and cable companies have ar- 
gued that their online sendees 
should bet given extremely high pro 

teoion fro m government surveD- 
iance under the Cable Act. 

*1fs time to update and harmo- 
nic our existing laws to give all 
forms of tedxnolog} 1 the same legis- 
lative protections as our telephone 
conversations," Podesta said. 

Lawmakers said they welcome 
the opport unity to work with t he ad- 
ministration on these issues. Sen, 

Omit G. Hatch (R-U&hh who has 
introduced an internet pricey bill, 
said: ‘It is imperative that we bal- 
ance the interests of law enforce- 
ment with the privsq r rights of the 



American people, We must ensure that appropriate 
checks are in place where the government accesses pri- 
vate eommmu cations of Americans* 

Pod esu said the bills making up the passage wouldbe 
tmveSed within 10 and that he hopes the legisla- 
tion can be passed by the end of theyear, 

Pbdesta also spoke about the new surveillance teefe- 
ttology known as Carnivore, which gives law enforce- 
ment authorities the ability to selectively monitor the 
' Internet traffic of mdbiduab. mmhr to the devices that 
can record the telephone numbers of calls made and re- 
cemd by* suspect Unlike full-fledged wiretaps, the jte 
, didal oversight of such surveillance 1$ slight, and the 
protection against abuses of the technology by kw en- 
forcement is vreajc Fodesta called for greater judicial 
oversight- 

The Fodesta speech was not well received by rivS Hh- 
erb'c^ advocates, who have fought Carnivore and other 
admixustratlon at tempts to expand wir etapping capabO- 
ities on the Internet Barry SteiaJwdt, associate direc- 
tor of the American Civil Liberties Union, called the 
speech ‘deeply disappomttog, , , While the Clinton ad- 


nMftsiratJon s proposals have some heartening qualit h 
to fhenuhey are too little and too late,* with too m 
tune m ihe legislative session to pass new' bills The Ca 
to system, Steinhank said, *r«pres«tts a m, 
threat to the privacy of all Americans by giving law er 
forcemeat agencies unsuo^mV-ri „ **** 


T ^ ^topantes win be me to export s 

pmsucaled cryptography products to users b. any n 

.krfrT 1 ! Ujiion b> Australia, No m * 
the X 2 eeh Republic, Bcng^v Poland, Japan, New Z& 
land and bwit^rknd. The government w3I diminat 
the statutory 3&day waiting period before such export 
enn take place but will keep m place a requirement ths 

I"? submitted to the government for 

techmcd reviews 

Encr>-ption has heea a high-tech batUeSeid from th 
early daw of the Ctoton admimsfratism. Few tedxaotc 
«*? 5*. 25 in the fight to maintain persora 

anti OEJ<tJn+*CQ ^ < >■. r 



Tt . , tr ** w - ^oraanent omoals like FBI I 
rector Louis X Freeh, who often wants that crimina 
and tmomts can use ‘crypto" to cloak their plans ar 
^.tonkes. High-tech companies successful}* argued th 
restrictions harmed only American comnanie 


encryption products, and in January thedmton admin 
istrakon reduced controls on encryption exports. 

The reducing of these regulations wiE certainly ah 
pw u,S. sofu-axe makers to compete m the global mar, 
ketpbce." s aid Robert HoOeynan, the chi^ oeccuti^f 
toe Business Software Aliianae, 



Fr&tn Associated Press 


^ White Heus< 

proposed leglsiatson Monday to update 
wiretapping rules so that feral nrotecr 
isom currently applied to telephone calls 
are extended to electronic communica' 
bom such as e-mail 

wouW - r KJ^re law enforce- 
“ o..iaafs to obtain high-level ap- 
proval before applying for a court order 
to intercept the content of e-tnail-in fine 

ropLTcan s Wteth3 \ fiOVeroi,Sts ^ 

B&sicsily, the same communicate if 
difkrent w 3 ,y ^through a phone 
cay or a dial-up modem— is subject to dtf- 
ierent and inconsistent privacy stand- 

‘ ^ ^ ouse Chief of Staff 

John Fofeu, in announcing the propot- 

*** >,]t - «*«» «> update &nd harmonize 
our existing lews to give all forms of tech- 
noior? the same legislative protectee a « 
our telephone con versations,^ 

The wiretap proposal also addresses so- 
caded "trap and trace"' orders, which ah 
lsw te enforcement officials to identify 
the source of a phone call or an e-mail 
but not Its content. Under the proposal 
kw enforcement officials would onlv 
need one order-even to trace an e-mail 
or a phone call that may travel through 
multiple phone carriers or Internet pro- 
viders, ' 


Officials also could trace such commu- 
nications without prior approval in an 


emergency situation, such as when a 
computer is under attack. 

But for the first time, the administra- 
te ts proposing that a federal or state 
judge independently determine whether 
the facts support such a trace order. ' 

Officials were asked how those changes 
would impact the new "Carnivore" sys- 
tem, which the FBI is using to obtain V 
mails of investigative subjects with a 
search warrant When Carnivore is 
piaced at an Internet service provider, it 
scans all incoming and outgoing e-mails 
for messages associated with the target of 
a criminal probe. 

If the Carnivore system, is being used 
to intercept the content of electronic 
communications, then law enforcement 

officials would need high-level Justice 
Department approval before obtaining a 
court order and stricter standards limit- 
ing m use would apply, Podesta said. 

The FBI says the tool already is $uh~ 

to intense oversight from ni own in- 
ternal controls, the Justice Department 
and the courts-with signification penal- 
ty for misuse of the system. 

The proposed measures also would ad- 
dress inconsistencies in^how current law' 
applies to different networks carrying In- 
ternet traffic. For example, now' that ca- 
ble systems are being upgraded to offer 
two-way services, laws that apply to dial- 
up modems over phone lines should be 
extended to cable connections. Podesu 
said. 


Y 
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on Encryption 
Software Exports 

ASHLEY DUNN 

and CHARLES WU» 

Tints st*H wsims 

The Clinton administration on Mon- 
day further eased the remaining re- 
strictions on setting high-powered en- 
cryption products overseas, clearing 
the way for American firms to export 
to the European Union and several 
other key trading partners* 

The new policy drops a requirement 
that U.S, companies get a special IV 
* cense to sell encryption products— a 
process that previously Involved a 
technical review or a 30-day delay . 

In addition, the rales allow compa- 
nies to sell their products to not only 
businesses and consumers, but also 
government agencies, which used to 
require a special license. 

The rules apply to encryption ex- 
ports to the 15 nations of the European 
Union, as well as Australia, Norway. 
Czech Republic, Hungary, Poland, Ja- 
pan. New Zealand and Switzerland, 
The new rules follow the adminis- 
trail's major turnaround in Jam*, 
**>*' it finally opened the way 
for companies to export the hardest- 
tocrack scrambling technology. 

American technology companies 
and pri vacy advocates had fought for 
years for permission to export its erv- 
ciyption technology abroad 
The industry argued that the 
spread of strong encryption would 
fuel electronic commerce and reas- 
^ire consumers that their credit card 
numbers and other private communi- 
cations would not bo compromised. 

Wltite House Chief of Staff John 
Podesu, speaking at the National 
Press Club, described the changes 
announced on" Monday as pan of an 
ongoing effort to update VS. policy* 

"The Internet, like Morse's tele- 
graph, brings with it new possihih 
h* said. "It also brings new 
challenges lo our most fundamental 
values and the need for new lawis and 
new protections to maintain them." 
Industry and security experts wel- 



comed the latest anno uncement as 
another sign of the federal govern- 
ment’s new-found support of liberal- 
izing encryption exports. 

1 "It s obviously very important if 
ILS. software companies are going to 
compete in the global market/’ said 
Ami? Vomit a former department of 
Defense security official and presi- 
dent of RipTeeh, a security company 
m Alexandria, Va. 

According to Scott Schnett, senior 
vice president of RSA Data Security, 
a top encryption software producer, 
the new rules are important because 
they remove restrictions to selling to 
national governments. 

Governments are often the biggest 
buyers of security software, particu- 
larly in the recently democratized na- 
tions of Eastern Europe . 

"Both the relaxation and mmalk 
nation around government use of the 
technology is a realisation of the core - 
importance of the security over the 
Internet,* Schnell said, 'This is a tre- 
mendous boost for the US. software 
industry" 

But others said that until the regu- 
lations can be thoroughly reviewed 
by legal experts, their impact would 
be uncertain. 

The devil in this case is in the de> 

tsus. said Jeff Schiller, a iiiading se- 
curiiy expert and netw ork manager 
for M^sachuseUs Institute of Tech- 
nology. Law enforcement and safety 
concerns remain, he said. "How are 
those addressed? I'd be very- sur- 
prised if they were just lifting the 
controls." 

He said that he suspects hidden re- 
strictions could still bar the export of 
soon products to the wrong coyn- 
toes. 

Let's &ay someone in one of the 
forbidden countries gets an 30 
coum on America Online," Schiller 
said. "When they use their Web 
browser to get m the Net, it’s go- 
ing to say Virginia [where many 
AOL server computers that route 
Internet traffic are located]. I don't 
know they are from Libya, Under 
those circumstances who is respon- 
sible? Am I responsible? k AOL re- 
sponsible?" 

But Schiller said that any relaxa- 
tion of export controls is an ac- 
knowledgment of reality, 

“You cannot turn the tide of 
technology back,” he said. "The 
bad guys are going to do what they 
will do/’ while legitimate users of 
encryption products are harmed by 
export controls. 
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Rules on encryption 
exports are relaxed 

The United States has eased its rules on exporting 
encryption products to the European Union and other 
key trading partners 
m an eflbrt to improve 
security in cyberspace 
^promote demon- 
ic commerce, the 
White House said 
Monday j 

US, companies no 
longer need an export 
license to sell eneryp- 
tion products to users 
in the key trading 
countries, the White 
House said, i 

The policy allows 
US. exporters to ship : 
their products without 
waiting for a technical 
re ^ ew 0f 3 

Podesta: Change should not delay as they have In j: 
threaten US, security the past. Businesses 
< , .. . , snd privacy advocates 

had said that US. export rules were too restrictive, but 
law enforcement oSdab said sophisticated encryp- 
tion aids international criminal enterprises and terro- 
rists, White House Chief of Staff John Podesta said the 
changes should prov ide adequate sexoihry : 

The White House also proposed legislation to up- 
date wiretapping rules so that protections currently 
applied to telephone calls are extended to electronic 
communications such as e-mail. The changes could af- 
fect the system the FBI uses to access the e-mails of 
criminal suspects, investigators would have to obtain 
high-level approval before seeking a court order. 
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House Rejects 
Bill Limiting 
Web Gambling 

Parties Sharply Divided; 
White House Opposed 


By Dam Mobcak 
and John ScHw^n 
3 T&skwgim B uss Staff S teers 

The House last night defeated a hill that 
would have barbed most forms d online gam- 
bling, fegiriatlon intended to curb the explo- 
sive growth of casino-style wagering on the 
World Wide Web. 

1ft a vote that rejected sharp divisions 
within both major parties over the issue, 44 
Republicans joined 114 Demccrats and one 
independent to defeat the measure. Under a 
procedure to bring the bill to the floor with' 
mi amendments, a two-thirds vote of those 
present u^as required to pass the legislation. 
The final vdty of 245 to 159 fell 25 votes short 
of the 270 needed. 

The feOI drew opposition from lawmakers 
and advocates concerned shout federal reg- 
ulation of Internet contend as wet! as the po- 
tential for invasion of privacy. Critics also 
raised concerns that to make the legislation 
palatable to the pobfrcaOy influential pm- 
mutud horse racing and dog racing in- 
dustries. GOP leaders had agreed In exempt 
lions that would actually legalise an 
expansion of opportunities lor online gam- 
bling; 

The bill was intended to address growing 
fears among lawmakers about the explosive 
growth of unregulated online sites where in- 
dividuals can engage in card games 
and other casincHtyk gambling on 
their computers. More than 700 such 
sites, many of them nut out of foreign 
countries or offshore havens, are now 
operating without regulation, with 
raugidv $12 billion wagered annu- 
ally. 

Under ih$ bill defeated yesterday, 
stale law enforcement agendes 
would have been able to go io court 
to obtain orders requiring Internet 
service providers to block access to 
Web sites that engaged m Illegal gam- 
bling 

Bef ore last night's vote ( Rep. Rob- 
ert W. GoodJsite {R-Va,}, chief Spon- 
sor of the bill, cited a bun} 1 of serial 
ilis linked to gambling-~crime, bank- 
ruptcy. addiction and more— and 
said that Internet gambling will bring 
drirens the same problems *as you 
would have If you had a casino in your 
home town. 4 * 


But the White House it 
*mm$f opposed the bill and 
stressed in particular its objections to 
the exemptions that would aBmv the 
parimumd industry to conduct on- 
Hne betting under cootroSed condi- 
tions. 

Although the Senate has passed a 
similar hi, it appeared unlikely kst 
night that the GOP kadersfejp in the 
House will attempt to bmg the meas- 
ure back to the House again tMs year 
gwea the Mted time and the diSS- 
culty of crafting a exnprombe on 
s^:ch a esmpiisx k&s&. 

Yesterdays vote w'as the cuk&na- 
tbn of one of flic year's most hotly 
, contested lobb>dng battles on Capitol 
Hill, generating a variety 1 of strange 
alliances on both sides. Allied with 
the Las Vegas casino Industry m sup- 
port of the MS have been rdigjous 
group* that are among the GOFs 
core group of supporters, including 
the Chnsfian Coalition, the Southern 
Baptist Gom'tntion, the Family Re- 
search Council and Focus on the 
Family. 

♦ But the booming high-tech bdus- 
try; whkh the GOP is als-u courting, 
had serious concerns, and a number 
of governors objected that the legisla- 
tion would not proride an exemption 
for stale lotteries to sell rickets onli ne 
within their own states. 

MeanwhOe. horse and dog raring 
venues have been fighting dedbring 
attendance, and stiffer comperirion 
from other forms cf betting. They 
saw the felS as a w*ay to ensure their 
long-term smyivsl by allowing them 
to marKCv their events over the Inter- 
net 

Goadktle assured House mem- 
bra yesterday that the parimutuel 

provisions only authorised what is al- 
ready kgal under riedera) gambling 
law, and did not constitute an expan- 
sion. Action, he said, wss essential on 
the larger Issue of earinc Kype gam- 
Ming. 

But the White House charged that 
bill would have brightened the likeli- 
hood that children and other vul- 
nerable groups would fee able to get 
unsupervised, unlimited access to 
mntibfig aoiviries on home comput- 
ers. 

This MB appears to be designed 
to protect certain forms of Internet 
gambling that currently are tBegafe 
whik potrnmy opening the flood- 
gate for other forms of illegal gam- 
bling/ the White House S3id in a 
statement 


Along with concerns about the 
parimutud betting provisions, some 
lawmakers m both parties expressed 
reservations about the extent of fed- 
eral incursion into the prerogatives 
of the state 

*You would have the federal gov- 
ernment dictate to Internet service 
providers what services they can of- 
fer/ said Rep. Christopher Cox (R- 
C&lif.) in opposing the kglsiatfom He 
said it was *w^8-mteotioned/ but 
would ^create enormous regulatory' 
probkuk/ 

Goodklie and the House GOP 
leadership sought to win more sup- 
port for the W with last-minute 
changes aimed at relieving some of 
the concerns of dvfl liberties groups. 
Rep. JerroM Nadler (D-N.Y.) agreed 

to support the legislation onlv after 
lanroage vrasadded giving thel opera- 
tors of Web rites that have been shut 
down fey court order up to 60 days to 
appeal ■ 

Yesterday's outcome represented 
another ina serfesof sometimes awfc- 
wiird attempts by Congress to ad- 
dress the controversial issue of reg- 
riatfog Internet content The 
Supreme Court struck down as m- 
consrit uriormfly broad the 1996 Corn- 
roumcatiom Decency' Act which 
made it « federal crime to make adult 
materials av-axt^ble to minors via 
computer. 

Congress came back with the 
Child Online Protection Act s nar- 
rower attempt to regulate commer- 
rial site showing pornography on 
the World Wide Web. That law fas 
been challenged fey dvfl liberties 
^oups and publishers, and is cur- 

before federal appeliatecouns. 
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‘Carnivore’ Won’t Devour Cyber-Privacy 


By Bwcz BmKomrz 
On Monday the White Hawse propose 
nm legislation regulating surveillance by 
law enforcement agendas on the Internet, 
But cm! libertarians are already complain- 
m && toi$ plan does little to address the 
problems ostensibly raised by Carnivore, 
the FBI's new software system tor perform- 
ing court-ordered wiretaps at Internet ser- 
vice providers USPs). 

Using a laptop computer, law enforce- 
ment officials can hook Carnivore into an 
ISP's network. Once installed, it reads the 
headers of each e-mail message -listing 
the sender, recipient and subject of the 
message- as it passes through. If the 
sender or recipient is the target of a taps 
Carnivore records the message, 

Rights at Risk? 

Here's the rub: Before Carnivore can 
know whether a message belongs to a tar- 
geted party, it must browse the headers of 
all the messages passing through the ISP. 
With a traditional phone tap, law enforce- 
ment officers only listened to the tele- 
phone line that the subject of the tap was 
using. The ACLU and other critics com- 
plain that when Carnivore reads the head- 
ers of anyone who. is not a target it vio- 
lates their rights. 

The ACLU and other Carnivore critics 
need to get a grip-and a better under- 
standing of the new technology. 

Unlike old-fashioned analog telephone 
calls, e-mail messages are transmitted dig- 
itally. A computer slices and dices the mes- 
sage into packets, each with an identify- 
ing tag. The packets then spread out 
throughout the internet, finding the most 
efficient path to the destination. When 
they arrive, they are reassembled, and the 
recipient gets the message. As a result, 
with e-mail you cannot “tap a line" be- 
cause often there is* literally, no particu- 
lar line to tap. All you can do is scan the 
messages that pass through a link a sus- 
peef is known to use -like his ISF-and 
pick out the ones that belong to him 
Thafs what Carnivore does. 

The ACLU complains that using a com- 
puter to monitor an ISP system would col- 
lect vast amounts of innocent data. But 
what do they expect toe feds to use~a 
writer ^ an abacus? Note to FBI: 
Hire a better public relations firm, and 
name your next project "Vegetarian.” 


These kinds of flaps are happening 
more and more often. Last April some pri- 
vacy advocates complained when the FBI 
requested $15 million tor “Digital Storm/ 
a program for monitoring telephone calls 
and analyzing recordings* fit September, a 
programmer to North Carolina found the 
no&tion “NSA Key*' in a Microsoft soft- 
ware patch. Soon rumors bounced through 
the Internet claiming Windows had a back 
door that allows the National Security 
Agency to monitor your computer, {ML 


There's a lot of concern about the ability 
of governments to monitor communications 
in tiie digital age , In fact, it's getting harder, 
not easier, for them to listen in. 


fttmot 
; tOttoM 

(vM 






emsoft explained that toe tag merely signi- 
fied that the software complied with the 
agency’s security standards.) 

The granddaddy of all bogus fears, 
though, is Echelon* If you believe some 
European Union parliamentarians, the 
United States and Britain operate an inter- 
national network that monitors virtually 
all commum cations* and extracts choice 
nuggets with powerful computers that ret> 
ogaiae key phrases in messages like “as- 
sassination/ “terrorist attack" or “indus- 
trial secret / 

in reality*, it’s not easy to find a specific 
message to a hood of free-flowing digital 
data* That’s the whole reason tor getting a 
court order for a wire tap. If you cannot 
hook into an ISP, you have to do a lot of 


searching to fmd the message you wart ic 
intercept. j 

Thai is also why the European elm- 
paign against Echelon is so quixotic. Tr 
the folks at N$A intercept communicati 
and they have powerful computers and 
genious software that helps with toe j 
cessing* But ft is impossible for even 
best computer system to routtnelv j 
through all of toe world’s tetommun 
Uons &hd pull out telltale messages, as the 
Echelon paranoids would have you 1 
iieve. 

" " — ■ Usually you n 

bout the ability to know what you 
„ - ^ v looking for i 

mmmkmtons Where the mess: 

getting harder. f** «»*» bef 

f * * you have much o 

m, chance of fmdingjfc. 

Also, the cases r ' 
which one messi 
tells a whole st< 

OWiv sre mt ' ^°°d i 

enforcement and 
telligence usual iy 
B quires mufti] 

S0Urce5 aM coll 
* u] ^formation 
^ tnske sense of an j 

fercept, 

ivfj mt5 have the 5 foJy 
revers ^- fUs gettii 
Sfe 3 >j harder, not cash 
for our law enforc 
Biff f mem and tote! 

^ gence crpnizaftoj 

to listen in on cor 
mtmicafions. In l) 
old days you could tap a line or intercept 
microwave link. It s much more difficult s 
capture digital messages that pass ov< 
fiber optics or bounce through cellular m 
worfei. And, with strong encryption sol 
ware freely available world-wide, anyor 
really determined to keep a message $< 
tret can usually do so. 

If you have any doubts, just recall hoi 
many intelligence surprises we have ha 
lafdy-fhe Indian nuclear test* toe Non 
Korean missile test, the terrorist bomt 
mgs of American targets in the Mideas 
and Africa, Part of the problem is that w 
cannot get to many of toe sources that w 
used to, and everyone is getting better a 
concealing their ccmmtmkafions. 


C 
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So why is K so easy to stir up these 
»ntrosmies about privacy? The simple 
met is tnat relations between the govern* 
ment and JAe mw information industries 
are fousy There is too much suspicion and 
too little communication. 

The administration gets part of the 
mm$ for Us ham handed policies. Carm* 
21* Sf™* **m&. A lot of contro- 
w ^ave ^C€ft defused if the FBI 
nad offered more insight info how the sys* 
to worked and how the rights of nonius- 
peets would be protected 

But the recart of the technogeeks has 
not been much better. Thev often act as 
though Jaw enforcement officials have no 
husasess poking into their activities at 
au~&$ though one could stop international 
compoter criminals with g good neighbor- 
hood watch program. 

)■ ? ~ 811 103 eaS}! 10 l9SB of the fact 
tnat Canuvore’s main targets are cvber- 
crtoinaJs-in other words, the kinds of 
crocks who are a plague on the Internet 
and target dot-com companies. Growth 
rates for internet shopping have been siip- 
ptng lately. According to some excerts 
wwry about whether their credit 
cart numbers and health records are safe. 
»ou would think that e-business would be 
hie first to support better Saw enforcement 
on the net 

Commas Goals,, , ' , 

Ail fhe good guys in this dispute nave 
twnmon goals. Defense and imeUirehce 
omeiafs warn to protect the nation’s cam 
mmmmns infrastructure. Law enforce* 
ment officials want to chase croote> and 
companies want the cops to catch them 
Consumers warn privacy The path to m i s 
me same: secure information systems 
reasonable cooperation from the private 

^F ess ' ive law enforcement 
and effective intelligence closely moni- 
tored by responsible public officials. ' ; 

Fixing the relationship between Wash- 
ington and Silicon Valley needs to be a Iod 
TO y for the next administration I rS 
wb people henefitung from controversies 
« «» wr Carnivore are terrorists 
rTtmirtals: und rogue states. 

ter-#ftemt*iscm&rck/eltowoi'iiie 

“ Ri * oottRfhor a/ * Best 
^^MeUyence m m infomatkm Age” 
frofo umwrstfy Press, fflOdh 
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Questions for the Record 
June 20, 2000 


Senator Kvt : 

Q; Is the NIPC able to proside indications and warnings of an attack? For example, does 
the Center have the ability to detect anomalous activity or patterns In key communications 
nodes that might indicate something is about to happen? 

The NIPC’s ability to perform “indications and warning” is dependent first and foremost 
on its ability to quickly gather information from multiple sources about an ongoing or imminent 
attack (whether an intrusion, a virus, a denial of service, or other form of attack). The NIPC 
does not operate any detection mechanisms on any government or civilian systems. Thus, we do 
not get “indications” in an automated sense from any detection devices. In tins sense, I&W in 
the cyber world is very different from I&W in tire nuclear missile or conventional weapons 
world, where radars and other devi ces can provide advanced warning of an attack. Rather, we 
get relevant information from intelligence sources, criminal investigations, “open sources” (such 
as media and the Internet), and from industry and government contacts. We “detect” anomalous 
activity in key communications nodes only if the owner/operator of that node detects it and 
informs the NIPC, an FBI Field Office, or another agency, or if we learn through criminal 
investigation or intelligence sources that the node is being attacked. Tire key to the NTPC’s 
ability to do this is the development of connectivity and close interaction with numerous Defense 
and Intelligence Watch centers, FBI Field Offices, other Law Enforcement organizations, 
computer anti-virus association groups, private and public Computer Incident Response Teams 
(CIETs) and Computer Emergency Response Teams (CERTs), foreign law enforcement 
agencies, and private industry (both individual companies and information sharing 
organizations). Over the past two years, the NIPC has made substantial progress in developing 
these relationships, but this is a continuing task and more work remains to be done. One of the 
main reasons for our extensive outreach programs is to build trust and willingness on the part of 
private companies to report cyber incidents to us, and these efforts am bearing fruit. In addition, 
PDD-63 directs other federal agencies to report incidents to the NIPC directly. Many agencies 
are doing this, but there is room for improvement with others. In addition to reports from 
companies and agencies, the NIPC Watch actively scans all available governmental and private 
sector sources for reports or information regarding cyber activity 1 , and interacts throughout each 
day with. other watch centers to share information. 

♦ ‘ 

Once information (or “indications”) of an attack is received and analyzed, the NIPC can 
issue a warning, alert, or advisory through numerous means, depending on the appropriate 
audience. Warnings can be issued to specific targeted companies through FBI Field Offices or 
by the watch directly; other federal agencies can be notified by e-mail, secure facsimile, and 
telex; state and local law enforcement can be warned by NLETS; industry can be warned through 
InfiaGard secure email and website and through ANSIR (an e-mail system that reaches tens of 
thousands of companies); and fee general pubic can be warned via fee NIPC webpage and the 

4- 
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news media. All of these mechanisms have been used numerous times (as discussed in the 
answer to the next question). 

Senator Kyi’s question goes to the heart ofl&W in the cyber world: should the Nation 
have the capability to detect intrusions into government or private sector systems in an 
automated fashion, without having to rely on human detection and reporting? The controversy 
attending the Administration's recent “FHMET” initiative, which is a limited proposal to place 
automated intrusion detection devices on federal agency networks, identified many of the privacy 
and other issues such a system would raise, particularly if it were extended to privately owned 
networks. The government’s approach at the present time is to encourage industry to protect and 
monitor its own systems, and to report anomalous activity voluntarily. The NIPC works within 
that overall policy to encourage private sector reporting as a critical part of its I&W. Examples 
of this include InfraGard and the incident reporting pilot program we have developed with the 
energy' sector through the North American Electrical Reliability Council (NERC). 

Q. How many warnings has the NIP C issued which were developed through the Centers's 
own analysis of activity'? 

Of the 54 tactical warning products disseminated since the NIPC was establi shed in 
February 1998, all were developed in whole or in part through the Center’s organic analytical 
capability' and analysis of activity. Some of these products were initiated by' the NIPC (e.e., the 
BAT/Firkin Worm, also known as the ,! 91 1” Worm), while others built upon basic analysis ’ 
initiated elsewhere (e.g., the NIPC assessments of Distributed Denial of Sendee tools). We 
cannot put a precise figure on the relative contributions, since these are all comm unity- 
collaborative products. In performing analyses and issuing warnings, the NIPC works closely 
with other government agencies, private sector organizations such as CERT (which is an FBI 
contractor), and the SANS institute, and academic institutions. 

In addition to warning products, the Center has produced hundreds of non-warning 
informational products. Since 1998 the NIPC has produced 301 daily reports, 30 CyberNotes (a 
summary and analysis of technical exploi ts and vulnerabilities), 5 1 Critical Infrastructure 
Developments reports (a report on recent cyber-related issues and incidents), and five IP Digests 
(a periodic, in-depth analysis of cyber threats and vulnerabilities). Versions of these analytical 
products go to private industry, to the Intelligence Community, other federal agencies (including 
law enforcement), and to criminal investigators. 

< 

Q: What- other agencies do you see playing a significant role in the area of computer crime 
investigations? _ 

Cyber crime is an issue that concerns not just, the FBI, and not just law enforcement 
generally. Indeed, "cyber crime” in itself should be seen as part of a broader array of cyber 
threats, including cyber terrorism, cyber espionage, and information warfare, since all are closely 
related and often difficult to distinguish at the outset of an incident. As a result, cyber threats are 
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of great concern to numerous federal agencies, including the Defense, Intelligence, and Law 
Enforcement Communities and to civilian "Lead Agencies” under FDD- 63 ; to state and local 
governments, including law enforcement; and, of course, to the private sector. It is because of 
this wide-ranging interest that the NIPC was established as an interagency center. The NIPC 
provides a locus and mechanism for coordinating the expertise and roles of many agencies, and 
fadhtates infonnarion sharing and operational coordination. Tire NIPC works closely on ’ 
investigative matters with many law enforcement agencies, including: die Secret Sendee 
Internal Revenue Service (IRS), Air Force Office of Special Investigations (AFOSI) Naval 
Criminal Investigative Service (NOS), United States Air Force Office of Special Investigations 
(AFOSI), Defense Criminal Investigative Service (DCIS), National Aeronautics and Space 
Administration Office of Inspector General (NASA GIG), Department ofEnergy (DOE), state 
and local law enforcement, foe Intelligence Community, as well as foreign law enforcement 
agencies through FBI Legal Attaches (LEGATS). * * ” 

there reasons, other than funding, which have caused other agencies to pull their 
personnel out of the MFC? For example does FBI management at the Center recognize 
th e expertise of the other agencies and allow them to fully participate? 

One of the difficulties in attempting to operate an interagency Center is ensuring that all 
relevant agencies participate. Agencies have not received direct funding to participate in foe 
Center, and so must take detailees to the NIPC out of existing personnel resources. In addition 
personnel with cyber expertise are unfortunately in very short supply, meaning that agencies 
must commit to take scarce resources and send them outside their agencies. Despite these 
impediments, numerous agencies have sent detailees to the NIPC, including: Defense/Office of 
the Secretary' of Defense; Central Intelligence Agency; National Security Agency; Air Force 
Office of Special Investigations; U.S. Navy; U.S. Army; U.S! Postal Sendee; Defense Criminal 
Investigative Service; Genera! Services Administration; U.S. Air Intelligence Agency; 
Department of Commerce, and foe Tuscaloosa, AL SherifF s office. In addition, we have foreign 
liaison representatives from two aliied countries who assist in coordinating international 
activities with our counterparts. A representative from FAA is also scheduled to start at foe end 
of June. Additional representative from DoD, CIA, and NSA are also slated to anive in foe near 
futnre. We are also expecting representatives from local Washington area police departments on 
a paii-tlme basis, ~ 


Some agencies were represented earlier but do not currently have representatives 
Circumstances necessitated foe recall of foe first State Department representative. State agreed 
to do so, and has committed to NIPC that it would replace him with two new representatives 
DoE’s first representative rotated back after more than two years, NIPC*s understanding as to 
why this representative rotated back is that he was at NIPC for a lengthy time and was needed at 
DoE headquarters to assist in a DOE reorganization. DoE has committed to replacing that 
detailee, „ * 

Secret Service earlier had two detailees to the NIPC, but recalled those detailees and has 
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not yet committed to replacing them. Secret Service has not provided any written explanation for 
this, but in oral discussions. Secret Service officials stated that USSS was not getting additional 
fending for its electronic crimes program despite its participation in NIPC; the FBI was receiving 
more media attention in the cyber crime area; and NIPC had not "referred" cases to Secret 
Service for investigation. NIPC offered any support it could give to Secret Service in addressing 
budget requests; noted feat NIPC public statements often referred to partnership wife USSS; and 
offered to do more to support USSS initiatives wife public statements and case analyses. NIPC 
also stated (as discussed further below-) feat its role is not to create and "refer" cases; rather, cases 
generally originate in Field Offices, and FBI and Secret Service field offices frequently work 
computer crime cases together. 

NIPC felly recognizes the value other agencies bring to fee cyber crime and infrastructure 
protection mission. That is why NIPC is an interagency Center, and has senior managers from 
other agencies in addition to investigators and analysts. For instance, fee MPC Deputy Director 
is from DoD/OSD; the Section Chief of fee Analysis and Warning Section is from CIA; the 
Assistant Section Chief of the Computer Investigations and Operations Section is from Air Force 
OSI; the Unit Chief of fee Analysis and Information Sharing Unit is from NSA; and the Unit 
Chief of fee Watch and Warning Unit is from the U.S. Navy. Secret Service fomrally occupied 
the position of Assistant Section Chief of the Training, Outreach, and Strategy Section. 
Recognition of the need for other agency participation is also what drives NIPC to continually 
seek additional representatives from other agencies. It is also reflected in the numerous joint 
inv estigations that NIPC and FBI Field Offices have been involved in with other agencies fas 
discussed further below). 


Qj How many criminal investigations have been referred from the NTPC to these other 
agencies? Does the Center have operating procedures to refer a case to another agency'' 

v * 


As a general matter, the NIPC does not "refer" cases. Cases are normally initiated by a 
field office, whether a Field Office of the FBI, the Secret Service, another federal agency, or a 
state or local law enforcement agency. NIPC is the "program manager" of fee FBI’s computer 
intrusion investigative program, and so receives information about cases directly from the FBI 
Field Offices. Under FDD 63, other agencies are also supposed to report information about 
cyber incidents to fee NIPC. Sometimes, NIPC wall receive fee first report of a cyber incident 
from a private company, a government agency, or another source, and contact fee appropriate 
FBIField Office. If another agency has concurrent investigative jurisdiction or some other non- 
investigative interest, feat agency will also be contacted (either by fee FBI Field Office of the 
NIPC). Where j oint jurisdiction exists, fee FBI field office may work jointly wife the relevant 
other agencies (as ^ discussed fkther below). 




If an inquiry determines fee complaint does not fell within the investigative guidelines of 
fee FBI, it may be referred by fee field office to another federal agency ox to a state or local law 
enforcement agency which has fee authority to conduct such investigations, FBI field offices 
develop liaison contacts wife federal, state and local agencies investigating similar violations 



under federal or state statutes and complaints are disseminated through these liaison contacts. 
There is no system established to track how many complaints have been sent front FBI field 
offices to other law enforcement agencies. 

There have been, however, several instances in which the NTPC or an FBI field office has 
contacted another agency to determine if that agency wanted to conduct an investigation either 
jointly or separately, but th at agency declined. A couple of examples are listed below. 

In May 2000, the FBI’s Detroit Field Office referred a complaint to the local Secret 
Service office regarding a denial of service attack against NHL.com, going so far as to transfer 
the call from the FBI field office to die Secret Service field office. The Secret Service told the 
complainant that no one was in the office to receive the complaint due to a visit of Texas 
Governor George W, Basil to Michigan. The complainant then called the FBI again and the 
Detroit Field Office took the complaint and assigned the matter for investigation. 

Also in May 2000, based on FBI source information, the NIPC notified the USSS 
headquarters that there may be a vulnerability with the Mute House Webpage that gave the 
public access to all the files on that server. The USSS advised that the system administrator mav 
already be aware of this. Neither the NIPC nor the FBI’s Washington Field Office has heard " 
back from the USSS regarding this matter. 

In another instance, the FBI’s Williamsport, Resident Agency, part of the Philadelphia 
Field Office, opened an investigation into a series of computer intrusion into 10 companies 
resulting in the loss of approximately 28,000 credit card numbers. During the initial 
investigation, the FBI discovered that one of the victims located in Buffalo, NY, had contacted 
the Secret Service and the USSS had opened a case pertaining to the intrusion against the single 
victim company, but was not investigati ng tire larger set of theft s. The FBI contacted the Secret 
Service Division in Buffalo, NY tp coordinate the case, since USSS already had a pending 
investigation. The FBI was told that due to the Security Detail Duties for the First Lady, the 
USSS would be unable to coordinate at the present time with the FBI on the case. 

Q. In previous testimony before this subcommittee Mr. Vatis has stated that the NIPC has 
referred approximately 800 cases for criminal Investigation. How many of these 800 cases 
actually Involved a real threat to our nation’s critical infrastructure? Would yon 
catagorize the recent Denial of Service attacks launched last month as an attack on our 
nation’s critical infrastructure? 

' * • 

In previous testimony before the sub committee, the approximate 800 numb er of cases 
that Mr. Vatis referenced were not cases the NIPC “referred,” hut was the numb er of computer 
intrusion, denial of service, or virus eases pending in FBI field offices at the time of testimony. 

As of May 1, 2000 there were 1,072 pending investigative cases.. 
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The nation s critical infrastructures” are those physical and cyber-based systems 
essential to the minimum operations of the economy and government, including 
telecommunications, energy, banking and finance, transportation, water systems and emergency 
services, both governmental and private. One of the most difficult aspects of cyber 
investigations is that it is not clear at the outset what the extent of the threat, or the potential 
damage to networiss, is. Each case must be thoroughly investigated to determine the level of 
tbreat and compromise. What seems like a relatively minor incident might ton out to be very 
significant, and vice versa. This means that it is much more difficult for field investigators to use 
traditional investigative thresholds in determining how to utilize scarce resources. Moreover, 
computer systems and networks employ trusted relationships between other computer system and 
networks, based upon the users' pri vileges. If a computer system or network is root-level (or 
super user) access compromised, the threat potential is substantial, and could theoretically pose a 
major threat to other trusted systems. This means that “critical infrastructure” systems are often 
connected with, and affected by, systems that are in and of themselves not critical. 

The existing NIPC database does not classify cases by critical infrastructure at this time. 
Thus of these 1,072 cases, there is no methodology to determine which ultimately constitute a 
threat to our nation’s critical infrastructure. However, we can cite several examples. 

The Distributed Denial of Service (DDOS) attacks launched in February of this year are a 
good example of the difficulty of categorizing an attack as an “infrastructure” attack or some 
lesser sort of attack. In a Distributed Denial of Services attack, not only are the "victim” systems 
affected, but also the thousands of computer systems and networks that were, unknowingly, 
infiltrated and used to carry out the attack, and Internet Service Providers that were heavily 
trafficked during the attack. All of the computer systems and networks that participated in the 
attack were compromised. Moreover, even though tire effect of the attacks was relatively 
ephemeral and brief, the knowledge gained by analyses of these attacks is critical to our ability to 
protect against more devastating attacks in the future. If the DDOS attacks had been directed * 
against the major Internet hubs rather than against primarily e-commerce companies, traffic on 
the Internet could have been paralyzed, disrupting several of the critical infrastructures that rely 
on the Internet for communication. 

Q* Besides Solar Sunrise and Moonlight blaze, what other joint investigations can you 
point to that demonstrate successful interagency cooperation? 

* 

Sinpe the founding of the NIPC in February 1998, there are numerous cases which have 
demonstrated successful interagency cooperation other than the significant Solar Sunrise and 
Moonlight Maze cases. The importance of these too cases should not be overlooked, however. 
Both represent sipificant milestones in building awareness of the cyber threat among federal 
agencies and poficymafcets, demonstrated significant vulnerabilities in DoD and other 
government systems, and presided opportunities to test and improve the NIPC’s processes for 
interagency coordination. 
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The following eases represent a small sample of these cases which have been 
successfully worked with other agencies: 

DDOS: Numerous Internet commerce sites have been victimized by DDOS attacks since 
February 7, 2000, These DDOS attacks prevented the victims from offering their web services 
on the Internet to Intimate users, A DDOS attack uses compromised computer networks to 
iiood a victim s computer network with massive amounts of data, which causes the victim’s 
computer network to become overwhelmed and to stop operating. The DDOS attack 
investigation are investigations in seven FBI field offices, five overseas Legal Attache offices 
other government agencies such as NASA as well as the Royal Canadian Mounted Police, ’ 
Reflecting the extraordinary level of cooperation on these investigations, on April 15, 2000 the 
Canadian officials arrested a juvenile charging him with one of the attacks. 

Qi radon On March 1, 2000, a computer hacker using the name, "Curador", allegedly 
compromised multiple E-commerce websites in the US, Canada, Thailand, Japan and the 
United Kingdom, and apparently stole as many as 28,000 credit card numbers. Thousands of 
credit card numbers and expiration dates were posted to various Internet websites On March 9 
2000, IntemetNews reported that Curador stated, "Law enforcement couldn’t hack their way out 
of a wet paper bag. They're people who get paid to do nothing. They never actually catch 
anybody.” After an extensive international investigation, on March 23, 2000, the FBI assisted 
theDyfed Powys (UK) Police Service in a search at the residence of Curador; Curador, age 18, 

V?’. a!on§ with m a PP arent co -conspirator under the Computer Misuse Act 
1 990. L nder United Kingdom lav,', both males have been dealt with as adults. Loss estimates 
are still bemg determined, 

- This case was predicated on the investigative work by the Dyfed Powys Police Service 
the Federal Bureau of Investigation, internet security consultants, the Royal Canadian Mounted 
Po ice, and the international banking and credit card industry'. Tins case illustrates the benefits 
of law enforcement and private industry, around the world, working together in partnership on 
computer crime investigations, * 


Burns. In August 1998, the FBI initiated an investigation on an individual only known as 
"zyklon,” who conducted numerous computer intrusions to various computer systems causing 
damages to websites and system files. The case was worked in cooperation with the Virginia 
State Police. The investigation identified zyklon to be Eric Bums of Shoreline, Washington. In 

f, 9 * f ° Il0Wing 20 executi0Q of a search warrant, Bums confessed to the intrusions In 

May 1999, Bums also gamed unauthorized access and defaced the webpage for the White House 
website. At that point the FBI began working with the U.S. Secret Service on the case. In 
September 1999, Bums pleaded guilty to one count for violation of Title 18 USC Section 1030 
(Computer Fraud and Abuse) for one of the 1998 intrusions. In the plea agreement. Bums also 
admitted his comma! activity mto several other intrusions including the White House website In 

J^ V oTn ber i9 "’ Buras was scntcaced to 15 mon&s in prison, 3 years supervised release and 
$36,240 m restitution and a $100 fine. 
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Xdfer o: This investigation was worked jointly with the Middletown Rhode Island Police 
Department, the state Office of the Inspector General (GIG), National Aeronautics and Space 
Administration (NASA), and the FBI. Sean Trifero compromised various company and 
University computer systems, including systems maintained by Harvard University, Amherst 
Co lege, Internet Services of Central Florida, Aliant Technologies, Arctic Slope Regional 
Corporation and Barrows Cable Company, He would utilize these compromised systems to 
establish web pages, E-Mail and Internet Relay Chat (IRQ Groups in the background of the 
victim, s ^P^^systjm Infer© would also provide others wife access to these compromised 
systems. On 10/6/1998, Trifero entered a guilty plea in fee District of Rhode Island in 
connection wife this matter. On 2/22/1999, Trifero was sentenced in connection with his guilty 
plea to five counts of violating Titlelg United States Code, Section 1030. He was sentenced to: 
months plus 1 day in jail; $32,650.54 in restitution; S500 special assessment; three years 
supervised release; five hours/wk community service for 36 months; use of the Internet but no 

contact with members of any hacking/cracking group. 

Msmm: Throughout 1996, National Oceanic and Atmospheric Administration (NOAA) 
suffered several computer intrusions which were also linked to intrusions occurring a the 

tartiwfm* S H (NASA) ' ^ inirusions coattacd 

through 1997. The FBI worked the ease jointly with NOAA. NASA, and the Canadian 

authorities and identified the subject, Jason G. Mewhiney, who resided in Canada. The original 

damage assessment feat Mewhiney had caused, exceeded $40,000. In April 1999, Jason G. 

Mewhiney was indicted by Canadian authorities. In January 2000, Mewhiney pleaded guilty to 

counts of intrusions which included violations spanning from May 1996 through Aorii 1997 

of destroyed/altered data and intrusions with the intent to damage. In the Canadian Superior 

Court of Justice, Mewhiney was sentenced to 6 months in jail for each of the counts to ran 
concurrently. ' 

lliss: In February, 1998, the FBI opened an investigation to assist the U.S. Air Force and US. 
^avy regarding multiple computer intrusions. The case was worked jointly with the U S Naval 
Cnmraal Investigative Service and Florida State Attorney's Office in Jacksonville, FL. * The 
subject was identified as Jesse Le Bliss, a student of the University of North Florida. On August 

2I ’- 1 ! S ^ 1SS?eaded §mty t0 ° ne felony count violation of Florida State Statute 815 06 

entitled Offense .Against Computer Users, On September 19, 1998, Bliss was sentenced in fee 
Fotnth Judicial Circuit, S tate of Florida, to six months house arrest followed by three vears 

™***ty> semce, and a written letter of apology to fee Commandant 
of the United States Marine Corps, 

CD, Universe : One pending case being worked by the FBFs New Haven Division and the U.S. 
Secret Service has been widely reported in the press, due to statements made to reporters by the 
alleged perpetrator. In December 1999, fee FBFs New Haven Division opened a case into fee 
mfiusions into fee computers of CD Universe, an on-line music seller, and fee theft of customers’ 
credit card numbers and a related extortion attempt. Because of fee credit card aspect fee FBI 
called the USSS to ask if USSS wanted to investigate jointly. The USSS declined. In January 
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2000, the New York Times ran a front page story about the case, based on conversations between 
the reporter and the alleged perpetrator. Subsequently, USSS called the FBI back and requested 
to work the case jointly. That case is still pending. • 

Other 

There are other investigations that are being conducted with other agencies, however 
further, details may adversely impact the investigation due to their pending status. There are 
currently 47 pending investigative cases which are being worked jointly between the FBI and the 
multiple entities of the Department of Defense. An additional 58 cases were investigated jointly 
with other entities that are now in closed status. 
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Senator Fdnstem : 

I. Under Presidential Decision Directive 63 (PDD 63), the .[sic... NIPCJ... is supposed to 
take the lead in naming of, investigating, and responding to threats to or attacks on this 
country s critical infrastructures. NTPC includes representatives from the FBI and other 
law enforcement agencies. Yon testified that the NIPC has improved the FBI's ability to 
fight cybercnme and that the FBI closed 912 cybercrime cases in the Fiscal Year 1999 and 
had 834 pending cybercrune cases that yean 

How many of the 912 closed cases involved threats to or attacks on our nations's critical 
infrastructures? Were these cases really a threat to our national security? What about the 

pending cases? How many involved threats to or attacks on oar nation's critical 
infrastructures? 

. y he nation’s “critical infrastructures” are those physical and cyber-based systems 
essential to the minimum operations of the economy and government, including 
te eeommumcations, energy, banking and finance, transportation, water systems and emergency 
services, both governmental and private. One of the most difficult aspects of cyber ' 

investigations ts that it is not clear at the outset what the extent of the threat, or the potential 
damage to networks, is. Each case must be thoroughly investigated to determine the level of 
threat and compromise. What seems like a relatively minor incident might turn out to fee very 
significant, and vice versa. This means that it is much more difficult for field investigators to use 
traditional investigative thresholds in determining how to utilize scarce resources. Moreover 
computer systems and networks employ trusted relationships between other computer system and 
ne vorks, based upon the users' privileges. If a computer system or network is root-level for 
super user) access compromised, the threat potential is substantial, and could theoretically pose a 
major threat to other trusted systems. This means that ‘'critical infrastructure" systems are often 
connected with, and affected by, systems that are in and of themselves not critical 

The existing NIPC database does not classify cases by critical infrastructure at this time. 
Thus, there is no methodology to determine which eases ultimately constitute a threat to our 
nation’s cntical infrastructure. 

The Distributed ^emal of Sendee (DDOS) attacks launched in February of this year are a 
good example ofthe difficultyof categorizing an attack as an “Infrastructure” attack or some 
s t °? ofa f ac ^ 111 2 Distributed Denial of Sendees attack, not only are the ''victim" systems 
affected, but also the thousands of computer systems and networks that ware, unknowinely 
infiltrated and used to cany out the attack, and Internet Service Providers that were hem! y 
trafficked during She attack. All of the computer systems and networks that participated in the 
attack were compromised. Moreover, even though the effect ofthe attacks was relatively 
ep emeral and brief, the knowledge gained by analyses of these attacks is critical to our ability to 
protect against more devastating attacks in the future. If the DDOS attacks had been directed 
against the major Internet hubs rather than against primarily e-commerce companies, traffic on 
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